Reverse engineering the Td5 ECU

I'm coming to the conclusion that I'm not going to be able to treat the TPU code as black box, so have been looking at manually disassembling the code, which is a bit of a mind bender.

Before getting too carried away I decided to check on a range of variant maps to see if the TPU microcode differed. All the EU3 maps I've checked (Disco, Defer, Manual, Auto) use identical code. The EU2 map I looked at was essentially the same but is missing one module used in the EU3 TPU code.

This is a better situation than I expected, as it means once the TPU code is disassembled it's done for all variants. :cool:

I've made some significant inroads into the CanBus code used to communicate with the Autobox. I'm hoping to be able to ID the data sent from the ECU to the Auto as this will give me a bit of a clue as to what locations hold what information.

cheers
Paul

Off Track this is some great work,

One thing that you might be able to figure out that why cruise control will not work with a vehicle that has an overdrive or certain gearing (read disco box on defender).

There is a market our there for a renewed firmware that would bypass this issue. I am one person in that market....

Thanks. I haven't looked into the cruise control as yet. I'd guess it's a matter of road speed vs rpm being out of the expected range with the different gear ratios. It might be as simple as using the D2 Manual values in place of the Defender values but I'd need to do a bit of digging to find the code that deals with this to know...

cheers
Paul

Might need to be careful modifying this as it could end up where the Cruise control tries to do 100 Kmh in second gear.

Quote:

---

Originally Posted by djam1

Might need to be careful modifying this as it could end up where the Cruise control tries to do 100 Kmh in second gear.

---

Unlikely. Unless, of course, someone is stupid enough to engage CC at 100km in second. The clutch switch kills CC operation.

Brilliant work Paul not many people even understand assembler these days let alone can dis-assemble it!

Going to power up my USB BDM in the next couple of weeks and start work on de-bricking my spare ECU so will let you know the outcome from your advice you previously have given me.

On a side note have you managed to find the register for max turbo boost which off the top of my head is 1.3 bar before it triggers limp home mode?

You shouldn't have too much trouble with the USB BDM. The config files I put together will let you upload the variant map and fuel map separately so you can preserve the original VIN etc if you need.

In terms of maximum boost pressure the limitation is the sensor. The bosch MAP/IAT on the Td5 has a maximum pressure of 250Kpa absolute. At 100kpa atmospheric pressure you are limited to roughly 1.5bar/22psi boost by the ECU hardware.

cheers
Paul

Damn this is super hard work you are doing Paul!
Thanks!

But how is the process going now?

It's going well but fairly slowly until recently.

Part of the issue with working through the code is that a lot of the "if ..., else ..." decisions depend on the state of a single bit in a 8 bit status word. To understand what the condition being checked requires following back in the code to the point where the state of that bit set or cleared. Until I have had a critical mass of this sort of information it's been hard to do more than plug away at bits of code that look like they are working on data you understand :)

The most progress has been made since I started looking at the code after tracing the path through the ECU hardware for the known sensor inputs: MAP/IAT, MAP, AAP, AAT, ECT, FT and TPS.

That has allowed me to work through the ADC conversion processes, with scaling and limit checking and error code setting on these inputs.

Over the last couple of months I've been able to progressively work through the flow of processing for the main processes. The main sections I've got substantially documented or completed are:
- engine sensor processing, including the consistency checking on the TPS
- air charge calculations from MAF and MAP/IAT
- driver demand lookups
- air/fuel lookups

I'm currently working through the injector duration and injection timing code.

cheers
Paul

Hi!
My names is Matteo and I write from italy.
I have seen the beautiful work you have done about td5 ecu. I love this motor but ther's one thing I really hate... the turbo limit!!! If i change the map sensor with the same bosch 350kPa can I overboost my def??? what do you think about???