PhatPhlatSix

Managed to fix it - I now have throttle blips below 2000rpm when the engine is warm!!!

Thanks to JasonAndreas for pointing out that there was a Cylinder Head Temperature Acceleration Enrichment map. I wasn't able to decipher his cryptic messages with regard to its location, so I went through each map that had temperature as an input and short-listed those with a likely-looking characteristic, i.e. decreasing output with temp. I then picked the one that had the most contribution around 40°C and petered out at 80-110°C. In fact there are 2 maps, one for each bank. I flat-lined these from 40-110°C.

Tested it this morning in the drive in to work - hole-in-one! It is such a pleasure being able to blip the throttle and do heel-n-toe at low rpm! I'm sooo chuffed!

alexjc4

Great detective work. Where they maps that were listed but not labelled in Pro2dme then?

Can't help thinking you are just masking a sensor issue somewhere though.

I wonder if any of the bosch hammer emulator OBD tools available allow logging of the sensors?

PhatPhlatSix

Yes, maps were in Pro2Dme but not identified.

I've wondered if it is a sensor issue, but then there were enough replies here that makes me think it is valid and widespread, but on the other hand how could a car be released to the public like that....

So, alexjc4, are you saying that you do not have any problems blipping the throttle when warm, below 2000rpm?

alexjc4

That's cool that pro2dme at least had the tables. As you probably know there are tools available that help you scan the rom image for regions that look like tables. There are also tools to disassemble the code on the microcontroller but thats a bit more advanced. I've only ever used the fruits from other peoples efforts using these sort of things - not used them personally.

Do you have a rom emulator or are you just burning a new bin and swapping the chip each time? The latest ones also show which memory is being accessed by the microcontroller which helps track down these issues.

Not sure my car would help much its just had a trick cam and chip fitted so it wouldbe hard to tell. I can't remember it being really bad before, but it was a bit lazy to pick up from low rpms/ idle which made for tricky heel toe practice around town.

PhatPhlatSix

No emulator, just blowing Eeproms. I've been really wary about the fact that pins and sockets, i.e. eeprom socket and ecu connector, have finite number of insertions, so I'm reluctant to do it too many times...

In the Pro2Dme help section, he explained how map axes are labelled in the hex image, with the quantities they represent, e.g. temperature, rpm, ign angle etc, and that proved really useful in targeting the right maps.

jevvy964

Excellent work dude, well done.

JasonAndreas

Excellent!

I reordered the list of maps you sent me (that was missing some) and gave you the map index (AE-CHT correction map - Index 9). Was that not the correct map? If not, what did you modify? I know of at least 20+ EPROMS for the 964 and what you'll find is that the absolute address (0x66E9) in your EPROM is only the correct location for some of them. All the maps are stored in a single list (array) and the ECU accesses that list via functional groupings which are defined in another location.

If you are going to play a lot, pick up an Ostrich and a Tadiran Battery so you won't have to worry about it for the next 30 years. You can mount it with velcro to the top of the ECU and pass the ribbon cable through the opening in the case. You also really need a way to monitor sensor values in realtime. Ideally you don't want them to change while you are making changes to the correction maps.

PhatPhlatSix

Hey Jason, in that last pm, you said that my list wouldn't align, so I thought that our maps were from different sources and I therefore didnt look at your data any more. I was also thrown off by the fact that there were two 4x1 maps and not a single 5x2 map, as you had said initially. But yes, 0x66E9 is the address of the first AE-CHT map.

Thanks very much for the Ostrich link, I will invest in that.

alexjc4

I have an Ostrich you can borrow, if you want to try it out

PhatPhlatSix

PM sent...

JasonAndreas

Its been a while but I just took a quick glance and I don't think the 2nd map is actually used?

PhatPhlatSix

Yes as above, but my editor shows a 4-breakpoint map in that location. Could it be that the 5th element is the DataType? Dont know about the 2nd map being used, but in my experience of 'Bosch-derived' systems, they always cater for banks individually, so I assumed this was the case here too.

Anyhow, we got there in the end, and I learned more by having to try work it out rather than being spoon-fed

Lorenfb

"Can't help thinking you are just masking a sensor issue somewhere though."

Yes, as few if any 964 owners have ever complained of this!
The 964 ECM design and its firmware is very robust in its optimization for performance
and drive-ability.

PhatPhlatSix

Yes, I'm quite open to that possibility. However, I had quite a few replies to this thread that said they had the same symptom, and there has been at least one other similar thread where the OP showed a video of it happening. I've tried 3 different ECUs, all with the same result, therefore it can only be sensor or harness. So either a lot of us have the same fault, or we all drive slightly differently....

JasonAndreas

The map itself is 4x1 in size and indexed off the CHT value. Its location in the ECU is at 5,2. The value is then used to correct a 2D fuel map (AE that is indexed off LOAD and RPM).

Unfortunately or fortunately, the only way to really understand how it works and figure out the maps is to disassemble the EPROM. You will never really get anywhere with address tracing or any of the "tools" that are included with the available ROM editors.

We need somebody with a brand-new O2 sensor to try this...