Thread: Reverse engineering the Td5 ECU

Off Track this is some great work,

One thing that you might be able to figure out that why cruise control will not work with a vehicle that has an overdrive or certain gearing (read disco box on defender).

There is a market our there for a renewed firmware that would bypass this issue. I am one person in that market....

Thanks. I haven't looked into the cruise control as yet. I'd guess it's a matter of road speed vs rpm being out of the expected range with the different gear ratios. It might be as simple as using the D2 Manual values in place of the Defender values but I'd need to do a bit of digging to find the code that deals with this to know...

cheers
Paul

Might need to be careful modifying this as it could end up where the Cruise control tries to do 100 Kmh in second gear.

Originally Posted by djam1

Might need to be careful modifying this as it could end up where the Cruise control tries to do 100 Kmh in second gear.

Unlikely. Unless, of course, someone is stupid enough to engage CC at 100km in second. The clutch switch kills CC operation.

Brilliant work Paul not many people even understand assembler these days let alone can dis-assemble it!

Going to power up my USB BDM in the next couple of weeks and start work on de-bricking my spare ECU so will let you know the outcome from your advice you previously have given me.

On a side note have you managed to find the register for max turbo boost which off the top of my head is 1.3 bar before it triggers limp home mode?

You shouldn't have too much trouble with the USB BDM. The config files I put together will let you upload the variant map and fuel map separately so you can preserve the original VIN etc if you need.

In terms of maximum boost pressure the limitation is the sensor. The bosch MAP/IAT on the Td5 has a maximum pressure of 250Kpa absolute. At 100kpa atmospheric pressure you are limited to roughly 1.5bar/22psi boost by the ECU hardware.

cheers
Paul

Damn this is super hard work you are doing Paul!
Thanks!

But how is the process going now?

It's going well but fairly slowly until recently.

Part of the issue with working through the code is that a lot of the "if ..., else ..." decisions depend on the state of a single bit in a 8 bit status word. To understand what the condition being checked requires following back in the code to the point where the state of that bit set or cleared. Until I have had a critical mass of this sort of information it's been hard to do more than plug away at bits of code that look like they are working on data you understand

The most progress has been made since I started looking at the code after tracing the path through the ECU hardware for the known sensor inputs: MAP/IAT, MAP, AAP, AAT, ECT, FT and TPS.

That has allowed me to work through the ADC conversion processes, with scaling and limit checking and error code setting on these inputs.

Over the last couple of months I've been able to progressively work through the flow of processing for the main processes. The main sections I've got substantially documented or completed are:
- engine sensor processing, including the consistency checking on the TPS
- air charge calculations from MAF and MAP/IAT
- driver demand lookups
- air/fuel lookups

I'm currently working through the injector duration and injection timing code.

cheers
Paul