ECU Tech

Td5 Tuning

I've had a few requests for details on how to disable the timeout on EU3 maps when the MAF sensor is disconnected.
Without this mod the throttle on EU3 maps is unresponsive for 20-30 seconds when the engine is first started.

A couple of months ago I posted on how the Wastegate Modulator operates when energised and de-energised.

That research was necessary because the “common forum wisdom” that the WGM operated to reduce boost seemed to be completely at odds with what the WGM control code appeared to be doing.

Note: There was a bit of doubt about the airmass units on my part. This has now been resolved and milligrams/stroke is the winner.

The first "secret' of the Td5 engine maps is that nothing is quite what it seems at first glance.

The "Old School" mod of choice..

Modifications to the inject duration maps are a key element of "old school" tuning.

The main of the function of the Fuel Temperature Sensor is to correct for the decrease in fuel density as fuel temperature increases.

RAVE states this quite clearly so no real surprises....

Note link to calculator spreadsheet added at bottom of post


The 1.42 bar boost limitation of the stock Land Rover Td5 engine management system has been a long standing issue when increasing boost levels as a performance upgrade.

The Nanocom .map and .tun formats is pretty much a standard for distributing remaps and loading different stock maps.

The donor XDF's identify a map that limits fuelling when overboost occurs, which I've named "Overboost Fuel Cut".
That naming seems to have created a bit of confusion as I've had a few people email asking if they should increase this map to match the torque limiter.

From the earliest versions the donor XDF’s have included an undocumented patch which is simply named MAF Patch.

A few people have asked what it does, and my response always includes something along the lines of “I really should document that!”.
So here it is finally - the documentation...

Axis Extending the Smoke Limit map is the secret weapon of the new school remap.

ECU Reverse Engineering

This is a bit of background on how the physical waste gate modulator unit operates.

I've been using the USBBDM NT interface to recover bricked Td5 ECU's and modify VIN information. As supplied the USBBDM NT lacks the required configuration to work with the Td5 ECU, so I have written a package of config files and a script that largely automates the recovery process.

I've been looking at the difference between the contents of the Nanocom .map format and the firmware image for an ECU loaded with the same variant and fuel mapping.

I'd initally intended to use a cheap parallel port BDM interface which used a free dos based software to do BDM programming but I decided that it was just too inconvienient to be practical. The PC I had setup usually lives in storage so it required a trip to retrieve every time I wanted to hook up the ECU. Needless to say it wasn't really conducive to being productive.

I've been doing a bit of work on using the Motorola BDM port as a means of recovering ECU's which have been bricked by a failed OBD port firmware upload.

Update: After doing further work on ECU I've discovered that the none of the speculation originally reported in this post is accurate and should be ignored. After locating the code that handles clock setup for the OBD-II communications I've been able to determine the crystal is actually 4.0768Mhz and the system clock runs at 16.3072Mhz.

Old content begins here:

This is a fairly niche modification.

EU2 and EU3 engines are fitted with significantly different airbox sensors.

The EU2 uses a three wire Ambient Air Pressure sensor, while the EU3 uses a four wire Ambient Air Pressure/Ambient Air Temp sensor.

I've spent a bit of time over the past few months trying to get my head around the firmware for the TD5 ECU. It's been a long tedious process but things are slowly falling into place.

I've been having a bit of trouble getting my head around what is happenning of the SPI bus of the Td5 ECU, so I've given in and ordered a Saleae Logic 8 channel logic analyser as a solstice present to myself.

One of the very early posts one this site shows a diagram of the firmware layout used on the Td5 NNN ECU's.

The portion of memory located between addresses 0x0000 - 0xFFFF was cryptically called "ECU Base Code", with the note that this is not touched during Nanocom .map uploads.