jovaan
Newbie
Karma: +1/-1
 Offline
Posts: 10
|
 |
« on: April 23, 2014, 10:57:09 AM »
|
|
|
Hi! I am new to this forum, found it by searching many ECU tuning forums and seems this is the most friendly one.
So I have Peugeot 406 coupe V6 with Bosch Motronic ME 7.4.6. I have MPPS tool to read (and hopefully write) bin from ecu, so far I did the reading and result is 64kb file. Even that was not straightforward, there is no official support for 7.4.6, but reading worked with Peugeot Motronic 7.5.x setting.
It seems almost impossible to find any info about this Motronic version. 7.5 xdf's don't apply, 7.1 xdf's don't apply.
Does anybody have an idea where to find some sensible xdf for this 7.4.6?
If nobody has xdf file, how about info that in which address parameters CDKAT and CWDLSAHK are on this ECU's bin?
As is obvious, I am trying to disable pre-cat probing and DTC. Any help is greatly appreciated!
|
|
|
|
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #1 on: April 25, 2014, 12:23:58 AM »
|
|
|
Hi !
I have the same car.
No Damos found on the net about this...
The file is doing only 64kb instead of 512kb because you don't have used bootmode (open of ECU is required).
This is not a problem to map and tune, but it's like that.
I suggest to you made a full backup before flashing.
Crash could income pretty fast...
|
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #2 on: April 28, 2014, 01:55:49 PM »
|
|
|
Thanks! I made bench flasher and removed ECU from car. It is made in France with licence from Bosch, which may explain many strange things...
I was able to read full 512KB bin today, grounding boot bin and reading with MPPS in Generic ME7.x boot mode read. As expected, the 64KB file I read via OBD II while in car are the 10000-1FFFF bytes in the full bin.
Now to the niceties... No freely available ME7 checksum calculator works or even recognized the bin. ME7 automated map finding can find only handful of maps, and no error codes, specifically no CDKAT I was looking for.
This seems to be a version on ME7 ecu where everything is different from BMW, Audi and Volvo ECUS.
I will post my progress here. I am currently looking into disassembling the actual code and going from there... any help is appreciated of course.
|
|
|
|
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #3 on: April 28, 2014, 02:07:27 PM »
|
|
|
WinOLS recognise ME7 from PSA / Renault.
If you wish, post your file, I'll try to look after CDKAT...
|
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #4 on: April 29, 2014, 02:34:32 AM »
|
|
|
Thanks for your offer! Here is the file. It is stock .bin read in bench from Peugeot 406 Coupe V6 2002 year model, ME 7.4.6 Ecu.
One extra bit of info: Ultima checksum calculator recognized PSA ME7 bin correctly and also calculates checksums. That is free SW available from internet with some searching.
|
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #5 on: April 29, 2014, 02:37:41 AM »
|
|
|
...also in addition, for anybodys interest, here is the XDF automatic mapper produced. It found some maps, but no flags at all.
|
|
|
|
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #6 on: April 29, 2014, 03:04:30 AM »
|
|
|
Hi, It seems that: CDKAT : 10009 CDLSH : 1000E Don't ask where I found it, I won't answer  . |
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #7 on: April 29, 2014, 04:17:37 AM »
|
|
|
Great, I owe you a dinner if you ever come to Tallinn!
Would you mind checking also where "CWDLSAHK - Code word for probe aging after KAT" is, I think I need to zero that also. If this ecu contains CDKATSP AND SPF, I need to zero those too I think...
Also interesting would be to know locations for...
CDHSH - Post cat O2 heater diagnosis
CDHSHE - Post cat O2 heater amplifier diagnosis
CDLATV - Lambda sensor aging diagnosis (tv) in OBDII-Mode (inverse: EURO-Mode)
CDLASH - Lambda sensor aging diagnosis (SHK) in OBDII-Mode (inverse: EURO-Mode)
CDLSH - Post cat O2 sensor diagnosis
CDLSHV - Lambda sensor sensor interchange recognition
CWKONLS - Vehicles with 4 installed sensors (default value 51 dec), set to 17[44] Vehicles with 2 installed sensors (default value 3), set to 1. When setting CWKONLS CDLSH must also be configured to prevent malfunction in circuit DTC's.
Change these to disable rear O2 lambda control:[45][46]
CLRHK (0x11A87) - Code word for Lambda - Control post cat on/off: set to 5 (00000101b)[47] or set to 73 (0x49/01001001b)? (original value 72 0x48/01001000b)
Wideband vehicles use CLRSHK. In these the default value is typically 16. Set bit 0 to disable (Increment value shown by 1)
CLRKA (0x11A72) - set to 0[48]
Finally if you intend to disconnect the sensors, configure ESKONF (13 bytes starting at 0x10C75):[49]. If you intend to leave the sensors installed and connected, there is no need to disable circuit diagnosis.
ESKONF[5] (0x10C7A) - set to 0xC0 (set bits 6 and 7)
ESKONF[6] (0x10C7B) - set from 0xF3 to 0xFF (M-box) (set bits 2 and 3)
ESKONF[6] (0x10C7B) - set to 0xC3 to 0xCF (L-box) (set bits 2 and 3)
But those are not so important for me at the moment.
I won't ask but I am very interested how you found them. Maybe WinOLS has these mapped in OLS250 file... or maybe you have code signatures that are not generally available...
|
|
|
|
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #8 on: April 29, 2014, 05:49:12 AM »
|
|
|
Yeah, I see you look for disable aging of cata.
I also think you are using the wiki for the S4.
Our ECU is not the ECU of S4, and there is some littles changes.
Some variables aren't same, and there is not Turbo (it change some things).
I tried to change this at begenning, but, some code are not accessible (like ESKONF, if you don't have the explanation of the makers or workers's ECU for this model, you can't touch it).
You can use the Alfa ME7 manual (foundable in this section) to understand the changes and what to do.
Some flag you want to modify are inverted (like put some function to 1 to disable them).
I think it could be more smart to change the monitoring of aging instead of disabling it, but I'll search the location if you want.
If I found, not sure to reply in public,but in PM, I can't send everything, sorry.
|
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #9 on: April 29, 2014, 07:48:57 AM »
|
|
|
Yes, aging cats.. Thanks for you for your help very much so far. I just set CDKAT to zero and went for a short drive, no P0420 P0430 yet, let's see what happens with few hundred kilometers.
Please don't send me any info that I cannot release here - I think information should be free, specially when we speak about 15 years old cars that cannot be big business to anybody. Or are you doing business with this info, then I understand it?
If CDKAT disable does not work, I will try to find the code block that sets the aging cat faults, and modify code accordingly. I'll post it here also if I do it.
Somewhere in this forum was link for IDA 5.1 with C167 support... I just can't find it now... removed?
Thanks again!
|
|
|
|
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #10 on: April 29, 2014, 02:54:32 PM »
|
|
|
I suppose IDA would emulate the ECU ? But it might be difficult to simulate the environnement... No idea where it can be. Let us know if you have aging diag again |
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #11 on: April 30, 2014, 08:22:41 AM »
|
|
|
Actually no, not for emulating, I would use IDA just to disassemble the original code to readable form, and make my own modifications and additions.
I have now driven 406 coupe through my test cycles, and no ageing cat DTC yet! I am hopeful it was enough to turn CDKAT to zero to accomplish this. However, did not look into readiness tests yet. If readiness for kat test shows "unavailable", that might mean not accepted technical inspection in some countries.
Many people say zeroing CDKAT is not enough, you'd still get p0420 and p0430. But I suspect zeroing only CDKAT works when other components are intact, for example I have completely working and good condition downstream lambdas, still attached. Probably if your downstream lambdas are bad, it can trigger also P0420 with CDKAT zeroed, I suspect that anyway. The of course also lambda-related DTC's would be triggered in most cases.
|
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #12 on: April 30, 2014, 08:25:02 AM »
|
|
|
Also, for community's sake, here is the current XDF I use for ME 7.4.6. It contains maps that were automatically detected with tool from this forum. Additionally, it contains those 2 flags, including CDKAT, maybe it can help somebody.
When I dig out more data I will make new versions of this XDF and post them here.
|
|
|
|
« Last Edit: April 30, 2014, 08:26:40 AM by jovaan »
|
Logged
|
|
|
|
titi65
Jr. Member
Karma: +1/-0
Offline
Posts: 43
|
|
« Reply #13 on: April 30, 2014, 11:25:56 AM »
|
|
|
When I can share, I do, else, I won't. I'll help you to find some maps witch could be usefull, and are pretty easy to find with a bit of habit. For you definitions: -Lamfa is wrong (it's 1D314, 10x6, I let you search a bit for axes and coeffs, just use logical). -KFZW and KFZW2 are correct. -KFZWOP (10494) and KFZWOP2 (10544) should never be less than KFZW and KFZW2. Try to use same original difference between map (ask if 'Im not clear about this). -The VVT is piloted at 19948, KFNW (0=VTC off ,128 = leave as it, 255 = VTC on). I've try some thing on mine, if you stay with unleaded gasoline, don't change anything. -KFMIRL and KFMIOP are easy to find, but useless to tune, I'll give it to you if you want to try some things. KFMIRL have a full 0 axis, and is full 16 bits; should have value from 0 to less than 8000. KFMIOP have no 0 axis, is full 16 bits, and high amplitude (low like 3000 and up to 60000). It's up to you to play |
|
|
|
|
Logged
|
|
|
|
jovaan
Newbie
Karma: +1/-1
Offline
Posts: 10
|
|
« Reply #14 on: June 01, 2014, 01:27:16 AM »
|
|
|
Just a short update on this project. I cleared the CDKAT flag (did not clear anything else), modified the bin checksum with Ultimo checksum calculator (only free tool I could find that can handle ME7.4.6), and benchflashed the new bin to ECU. After 300 kilometres of various driving, I can confirm the aging cat P0420 and P0430 are gone.
Only thing I have not been able to confirm is the state of readiness, Lexia (Citroen official tool) that I use for realtime diag does not have the feature to show readiness of systems in ECU. I suspect the readiness status on antipollution system may be "unsupported", which would be MOT fail in some countries. However, here in EE, it is not.
Best solution would be to modify the code to always pass aging diag with approve, then readiness would become OK also. But since no need for that just now, I will not start reverse engineering project.
|
|
|
|
|
Logged
|
|
|
|
|
