Pages: [1]
Author Topic: Haldex Gen 4 Project  (Read 9229 times)
Shauno
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 2


« on: November 25, 2014, 03:02:10 AM »

Hi All,

My first contributing post so please be gentle. Looking for a nudge in the right direction here. Looking to read the software out of a 2011 Audi TT RS Haldex Gen 4 module. Have had experience with engine ecu's etc but no matter what I try I cant seem to get a data read out of this module. More than happy to share my results with other forum members so any help with pointing me in the right direction would be appreciated. Have seen some post regarding Gen 1 and 2 modules but not Gen 4.

Trying to get the data out of this module with the aim to disassemble the software and be able to make changes to torque split etc.

So here is where I am at the moment:

Tools I have: VCDS cable, MPPS cable, Galletto cable, FGTech Galletto 4 BDM, nefmoto software, 3 standard Haldex Modules etc

I have removed the cover and found it runs a ST10F272M processor. Have tried nefmoto and FGtech to read the data via CAN wires but no response from module (Possibly due to not being in bootmode?) I seem to be slightly confused as everything i can find on ST10F chips uses K line communications but this module only has CAN H and L connections. Got the data sheet for processor. Have tried to force the module in to boot mode as other ST10F chips run by running 100k resistor to pins for RESETIN (pin 140) to ground, tried also removing resistor on pin 141 as some other ST10F seem to use to ground but no change. Checked the board with a meter for potential BDM pads. Only found one in the middle of the board with 2 ground pads next to each other but no 3.3v or 5v programming voltage on what would be pin 1.

So what I'd like to ask is what would be the best way to proceed? Try and BDM somehow? Is it possible via Can? How could i activate boot mode if so?

Not sure if I've missed a simple step or something obvious or if a resistor needs to be installed somewhere to activate boot mode but this is my first solo project and I'm still in the learning stages.

Like I said I don't expect someone to do everything for me but if someone has had experience with this chip or module and could give me a hint as to what I'm doing wrong i would be greatly appreciative.



Cheers
Shauno
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1598


« Reply #1 on: November 25, 2014, 05:17:40 AM »

Hmm,

what i found:

http://www.st.com/web/en/resource/technical/document/datasheet/CD00147652.pdf
http://epubl.ltu.se/1402-1617/2009/122/LTU-EX-09122-SE.pdf
http://nefariousmotorsports.com/forum/index.php?topic=4983.0

i have no clue, im just good at google but it looks like this thing could be forced into bootmode via can.
Logged
Hollywood
Full Member
***

Karma: +6/-1
Offline Offline

Posts: 60


« Reply #2 on: March 17, 2015, 01:49:12 PM »

Flip it over.... there is a AM29F200BB . Similar to the chip used in our ECUs. Id imagine you could place the chip on an ME7 board and read it in boot mode for lack of hardware to read it.
Logged
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655


« Reply #3 on: March 17, 2015, 03:39:39 PM »

Flip it over.... there is a AM29F200BB . Similar to the chip used in our ECUs. Id imagine you could place the chip on an ME7 board and read it in boot mode for lack of hardware to read it.


not on gen4. only gen2. gen4 has internal 256kb.
Logged
Piar
Jr. Member
**

Karma: +0/-3
Offline Offline

Posts: 28


« Reply #4 on: January 05, 2023, 10:22:25 AM »

in attachment original haldex gen 4 file from rs3 2012
i have convert sgo to bin using winols software
Have anyone tryed to understand logic? find damos?
Logged
Danielsvamp
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 4

yo


« Reply #5 on: November 02, 2023, 12:09:00 AM »

in attachment original haldex gen 4 file from rs3 2012
i have convert sgo to bin using winols software
Have anyone tryed to understand logic? find damos?

This is cool  Shocked

Did you read this from the car yourself? If so, could you give some hints to how to go about this?  Huh
Logged
d3irb
Full Member
***

Karma: +134/-1
Offline Offline

Posts: 195


« Reply #6 on: November 02, 2023, 08:53:12 AM »

This is cool  Shocked

Did you read this from the car yourself? If so, could you give some hints to how to go about this?  Huh

This was converted from the VW flash update database (Flashdaten) out of an SGO file. It's what VCDS sends over the diagnostic interface to update the module. It's likely (although I haven't disassembled it to look) that it's not quite 100% of what's running on the control module - usually there is a stub bootloader which isn't uploaded over OBD. But the full application logic and calibration should be here, and can be reversed to locate the calibration tables.
Logged
Danielsvamp
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 4

yo


« Reply #7 on: November 08, 2023, 04:06:34 AM »

This was converted from the VW flash update database (Flashdaten) out of an SGO file. It's what VCDS sends over the diagnostic interface to update the module. It's likely (although I haven't disassembled it to look) that it's not quite 100% of what's running on the control module - usually there is a stub bootloader which isn't uploaded over OBD. But the full application logic and calibration should be here, and can be reversed to locate the calibration tables.

Thanks for the info, will read up on this  Grin
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.02 seconds with 17 queries. (Pretty URLs adds 0s, 0q)