Pages: 1 ... 11 12 [13] 14 15 16
Author Topic: Tuning instrument cluster gauges for Audi/VW/Seat/Skoda  (Read 125987 times)
pedropp93
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 15


« Reply #180 on: February 13, 2022, 07:49:13 PM »

I know how the checksum works on VDO Audi clusters ( a4 B5 , A6 c5 , A3 8L ) - but it's hard to explain because I dont't know everything. I will try to prepare a dump screen with selected bytes for two types of checksum.

For sure it works different beacause in Audi K value is fixed , and recoding doesn't fix def error.

I am currently looking for a different way to do this. I am wondering how VCDS changes the k-value with Soft-Coding  back to 4182?  For example, if coding is XXXX5 then module could be looking somewhere in its EEPROM for matching value for coding digit 5 which should be 4182. But if my EEPROM is actually modified with 3480 k-value and I havent found any other 4182 value in EEPROM, than how the hell it knows to put 4182 in that specific address?

I am looking for a clue, where this 4182 k-value is stored for VCDS, so I could change it to 3480 so that it will set 3480 instead of 4182 with recoding with XXXX5. This should allow me to recode with my desired k-value and automatically calculate and correct checksums, so that def error would be cleared (or maybe I am wrong, and this is not cheksum that causes def error? any other options for that?)

Any idea where to look? I guess that finding proper CRC algotihm and also finding place to put checksum could be pain.

By the way, I cannot code any other last digit than 5. Even VCDS hint label shows that only option is 5.

Logged
elektronik13
Full Member
***

Karma: +10/-32
Offline Offline

Posts: 198


« Reply #181 on: February 14, 2022, 03:57:53 AM »

I am currently looking for a different way to do this. I am wondering how VCDS changes the k-value with Soft-Coding  back to 4182?  For example, if coding is XXXX5 then module could be looking somewhere in its EEPROM for matching value for coding digit 5 which should be 4182. But if my EEPROM is actually modified with 3480 k-value and I havent found any other 4182 value in EEPROM, than how the hell it knows to put 4182 in that specific address?

I am looking for a clue, where this 4182 k-value is stored for VCDS, so I could change it to 3480 so that it will set 3480 instead of 4182 with recoding with XXXX5. This should allow me to recode with my desired k-value and automatically calculate and correct checksums, so that def error would be cleared (or maybe I am wrong, and this is not cheksum that causes def error? any other options for that?)

Any idea where to look? I guess that finding proper CRC algotihm and also finding place to put checksum could be pain.

By the way, I cannot code any other last digit than 5. Even VCDS hint label shows that only option is 5.


Look in flash for the CPU
Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #182 on: February 14, 2022, 04:40:08 AM »

Do you have any CPU flash file? Or how to read it?
Logged
elektronik13
Full Member
***

Karma: +10/-32
Offline Offline

Posts: 198


« Reply #183 on: February 14, 2022, 08:20:54 AM »

Do you have any CPU flash file? Or how to read it?
these counters nobody reads processors because they are not needed for anything
Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #184 on: February 14, 2022, 11:32:21 AM »

I'm trying to find place in EEPROM which is related to ABS/ESP in A6 C5 cluster (4B0920933N). I have to change that part to behave same as on S3... I hope that the CPU flash can help... Or do you have some other hint?

Does anyone know how to calculate checksums and where to put them? Smiley
I have some XLS file in computer that can calculate checksum on 0xB0... And I successfully used it in the past...
« Last Edit: February 14, 2022, 11:47:01 AM by veigy » Logged
macxxx
Sr. Member
****

Karma: +29/-1
Offline Offline

Posts: 498


« Reply #185 on: February 14, 2022, 01:32:29 PM »

what difference in behaving?
Logged
elektronik13
Full Member
***

Karma: +10/-32
Offline Offline

Posts: 198


« Reply #186 on: February 14, 2022, 04:24:53 PM »

I'm trying to find place in EEPROM which is related to ABS/ESP in A6 C5 cluster (4B0920933N). I have to change that part to behave same as on S3... I hope that the CPU flash can help... Or do you have some other hint?
I have some XLS file in computer that can calculate checksum on 0xB0... And I successfully used it in the past...

if you don't want them enough, enter the mass for the output pins
Logged
pedropp93
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 15


« Reply #187 on: February 14, 2022, 06:07:30 PM »

I'm trying to find place in EEPROM which is related to ABS/ESP in A6 C5 cluster (4B0920933N). I have to change that part to behave same as on S3... I hope that the CPU flash can help... Or do you have some other hint?
I have some XLS file in computer that can calculate checksum on 0xB0... And I successfully used it in the past...

Would you share? Cheesy


Look in flash for the CPU

What do you mean by that?

By the way I guess (based on your nickname) that you are from Poland and so do I. If I am right, we can talk a little on Facebook Cheesy

Anyway, I tried everything, without luck Sad .

I did as follows.
1) took eeprom with desired k-value and speedo scale.
2) loaded it into dash. Of course it caused def.
3) recoded it in VCDS. Def is gone but so is my custom k-value
4) read this recoded eeprom from dash
5) compared it with version that causes def error
6) copied all cells that were different - from "recoded, no error, overwritten undesired k-value" to my "def error, custom desired k-value" eeprom (6 different bytes total). I have only left my desired k-value, everything else is the same as in "no error recoded" eeprom.

I was hoping, that if I copy all these different values, I would copy also checksum and other stuff that is under control test, and I would bypass def error. But no luck.

My observation is that recoding changed not only k-value back to factory. It changed 6 other bytes, but no idea of their functions. These are:
Address: value from def eeprom -> value from "after recoding with no def" eeprom
0x5C: 5EC0 -> C89D
0x14A: 0000 -> 0002
0x190: 0324 -> 030C
0x192: 0D98 -> 1056 (this is k-value, that was returned form my desired 3480 to factory 4182)
0x4BE: 0000 -> 0032
(note that it is 6 bytes difference, despite 5 addresses. First address has both bytes different)

Seems like two options:
1) this dash just won't accept k-value other than factory. And def is not related to checksums, but to the k-value only
2) it is still necessary to recalculate checksum and have it corrected already when writing eeprom. It could be possible, that for example, after reseting ECU (and it is necessary to reset ECU in order to new eeprom work so I can't pass this step) the dash calculates again checksum in order to validate it with this one that is currently in eeprom (but without correcting it). And I don't have this correct checksum present in any time in my custom eeprom with desired k-value (more probable scenario)

Any other ideas? Maybe other fix for def, without recoding necessity?
« Last Edit: February 14, 2022, 06:09:21 PM by pedropp93 » Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #188 on: February 15, 2022, 04:24:16 AM »

Would you share? Cheesy
There is some text that you have to translate to your language (i translated it in the past from russian to czech)...
Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #189 on: February 15, 2022, 04:29:01 AM »

what difference in behaving?
Its not posible to turn off ESP via button.... I have A6 C5 cluster in Audi TT 8N which is same as S3 8L. The difference is that TT/S3 have ATE ESP unit but A6 C6 have Bosch ESP unit. There is probably some different behavior between them and software in instrument cluster is probably cooperating with ESP unit. I can't figure out where to change that behavior.
« Last Edit: February 15, 2022, 04:57:27 AM by veigy » Logged
elektronik13
Full Member
***

Karma: +10/-32
Offline Offline

Posts: 198


« Reply #190 on: February 15, 2022, 05:49:57 AM »

Would you share? Cheesy


What do you mean by that?

By the way I guess (based on your nickname) that you are from Poland and so do I. If I am right, we can talk a little on Facebook Cheesy

Anyway, I tried everything, without luck Sad .

I did as follows.
1) took eeprom with desired k-value and speedo scale.
2) loaded it into dash. Of course it caused def.
3) recoded it in VCDS. Def is gone but so is my custom k-value
4) read this recoded eeprom from dash
5) compared it with version that causes def error
6) copied all cells that were different - from "recoded, no error, overwritten undesired k-value" to my "def error, custom desired k-value" eeprom (6 different bytes total). I have only left my desired k-value, everything else is the same as in "no error recoded" eeprom.

I was hoping, that if I copy all these different values, I would copy also checksum and other stuff that is under control test, and I would bypass def error. But no luck.

My observation is that recoding changed not only k-value back to factory. It changed 6 other bytes, but no idea of their functions. These are:
Address: value from def eeprom -> value from "after recoding with no def" eeprom
0x5C: 5EC0 -> C89D
0x14A: 0000 -> 0002
0x190: 0324 -> 030C
0x192: 0D98 -> 1056 (this is k-value, that was returned form my desired 3480 to factory 4182)
0x4BE: 0000 -> 0032
(note that it is 6 bytes difference, despite 5 addresses. First address has both bytes different)

Seems like two options:
1) this dash just won't accept k-value other than factory. And def is not related to checksums, but to the k-value only
2) it is still necessary to recalculate checksum and have it corrected already when writing eeprom. It could be possible, that for example, after reseting ECU (and it is necessary to reset ECU in order to new eeprom work so I can't pass this step) the dash calculates again checksum in order to validate it with this one that is currently in eeprom (but without correcting it). And I don't have this correct checksum present in any time in my custom eeprom with desired k-value (more probable scenario)

Any other ideas? Maybe other fix for def, without recoding necessity?
maybe the 4D98 will be fine
i have skype if you want
« Last Edit: February 15, 2022, 06:07:57 AM by elektronik13 » Logged
macxxx
Sr. Member
****

Karma: +29/-1
Offline Offline

Posts: 498


« Reply #191 on: February 15, 2022, 07:29:17 AM »

Its not posible to turn off ESP via button.... I have A6 C5 cluster in Audi TT 8N which is same as S3 8L. The difference is that TT/S3 have ATE ESP unit but A6 C6 have Bosch ESP unit. There is probably some different behavior between them and software in instrument cluster is probably cooperating with ESP unit. I can't figure out where to change that behavior.
Did you try to use a s3 8l dump?
Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #192 on: February 15, 2022, 07:58:43 AM »

I would love to, but this is crypto cluster so I think its not possible... Or is?
Logged
macxxx
Sr. Member
****

Karma: +29/-1
Offline Offline

Posts: 498


« Reply #193 on: February 15, 2022, 08:27:16 AM »

4b0920933N is also a crypted cluster so... write a s3 dump that is also from a crypto cluster. Maybe there will be def but you will test if the esp behaviour changes.  At any time you can go back to your dump without any problem.

As long you write a dump from a crypto cluster you are safe , if you write a dump from a non- crypto cluster its worse but also it can be repaired.
 
Its easy to know if its a non- crypto cluster - the middle part of dump is ful of FFFFFF.... In crypto there is some data.
Logged
veigy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #194 on: February 15, 2022, 02:26:38 PM »

Thank you very much! I have spare A6 C5 cluster no crypto... I sucessfuly flashed this cluster with A3 eeprom while ago Smiley I will try that in car!
Logged
Pages: 1 ... 11 12 [13] 14 15 16
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 18 queries. (Pretty URLs adds 0s, 0q)