AF#3 (Rear O2 sensor) correction limits

Epp14 · **Joined:** Sat Nov 11, 2017 11:55 am **Posts:** 3

Thanks Lorax. I tested today and those were the right ones.

The Lorax · **Joined:** Tue Nov 04, 2014 7:51 am **Posts:** 219

Epp14 wrote:

Thanks Lorax. I tested today and those were the right ones.

Great, glad it's working for you.

bludgod · **Posted:** Thu May 31, 2018 5:09 am

anyone able to dig out the table locations on AE5K500L /AE5K611L/AE5K700L/AE5K800L (2012 USDM WRX)?

quick search through for "3F00 0000 BF00 0000" and I can see:
AE5K700L -
338d8
3496c
35538
35d6c
37eec

AE5K800L -
338D8
3496C
35538
35D6C
37EEC

but my ida skills are lacking to narrow it down further

The Lorax · **Joined:** Tue Nov 04, 2014 7:51 am **Posts:** 219

bludgod wrote:

anyone able to dig out the table locations on AE5K500L /AE5K611L/AE5K700L/AE5K800L (2012 USDM WRX)?

Code:

AE5K500L
AF_3_CL_Target_Compensation_Limits_High 000333D0 
AF_3_CL_Target_Compensation_Limits_Low  000333D4 
AF_3_Correction_Limits_High             00034F90 
AF_3_Correction_Limits_Low              00034F94 
AF3_Learning_limits_High                000357C4 
AF3_Learning_limits_Low                 000357C8 

AE5K611L
AF_3_CL_Target_Compensation_Limits_High 000339F8 
AF_3_CL_Target_Compensation_Limits_Low  000339FC 
AF3_correction_limits_High              00035658 
AF3_correction_limits_Low               0003565C 
AF3_Learning_limits_High                00035E8C 
AF3_Learning_limits_Low                 00035E90 

AE5K700L
AF_3_CL_Target_Compensation_Limits_High 000338D8 
AF_3_CL_Target_Compensation_Limits_Low  000338DC 
AF3_correction_limits_High              00035538 
AF3_correction_limits_Low               0003553C 
AF3_Learning_limits_High                00035D6C 
AF3_Learning_limits_Low                 00035D70 

AE5K800L
AF_3_CL_Target_Compensation_Limits_High 000338D8 
AF_3_CL_Target_Compensation_Limits_Low  000338DC 
AF_3_Correction_Limits_High             00035538 
AF_3_Correction_Limits_Low              0003553C 
AF3_Learning_limits_High                00035D6C 
AF3_Learning_limits_Low                 00035D70 

covertrussian · **Joined:** Tue Jan 28, 2014 10:48 am **Posts:** 120

Can anyone with IDA help me with 2012 2.5i Legacy/Outback EE5K801W Compensation/Correction/Learning tables? These are different enough that I'm having a hard time telling what's what.

Rom & initial definition by td-d is here: viewtopic.php?f=34&t=9471

Using Hex editor I found the following floats, but it's a bit too many of them to easily/safely test with process of elimination.

(-0.5, 0.5)
3F 00 00 00 BF 00 00 00
323D8
330B8
33C6C
344A0
35C44

(0.5, -0.5)
BF 00 00 00 3F 00 00 00
C4154
C4174
C9FCC
D25A4

EDIT: td-d found the all of the definitions in this post.

td-d wrote:

covertrussian wrote:

td-d, or anyone else, can you fine folks help me with 2012 2.5i Legacy/Outback EE5K801W Compensation/Correction/Learning tables? These are different enough that I'm having a hard time telling what's what.

Rear O2 comps at 33C6C
AF3 correction at 35C44
AF 3 learning at 344A0

jayd26 · **Joined:** Sat Dec 12, 2015 12:55 am **Posts:** 23

A2ZJ500I

ROM:0005D178 AF3_Adder_Remove:.float 0.00049999997
ROM:0005D17C AF3_Adder_Add: .float 0.00034999999

rear O2 comps at 26AAC

hitautomotorsport · **Joined:** Mon Nov 05, 2018 6:53 am **Posts:** 19

The Lorax wrote:

rozsko wrote:

Thanks for all the info in this thread.
Unfortunately I don't have IDA pro as it is quite expensive compared to what I would use it for, but I was able to check my rom (A8DK100Z - 07 EDM STi) and did a hex search as mentioned earlier.
There are three matches in my rom, and one (the first one) of them was matching with the 07 WRX address mentioned in an earlier post, so I gave it a try. I actually tried all three addresses and fortunately nothing vent wrong. :mrgreen:

So for A8DK100Z it is #029A60 and right after re-flash, AF correction#3 was stuck to 0% from the earlier value of ~-45%.
(of course first I was logging the 16bit ecu version monitor

and that gave me a -50% value, but after some time, I realized there is a 32bit ecu version of the same and that was showing 0%)

Based on td-d's work from here and here

Code:

29A60 AF_3_Correction_Limits_High:.float 0.5
29A64 AF_3_Correction_Limits_Low:.float -0.5

27AE0 AF_3_CL_Target_Compensation_Limits_Low:.float -0.5
27AE4 AF_3_CL_Target_Compensation_Limits_High:.float 0.5

td-d, sent you an email, did you receive it?

Can you please explain how i should include these tables -add what and where ?

hippotuning · **Joined:** Mon Feb 12, 2018 11:14 pm **Posts:** 2

AZ1G701V 2010 WRX 3364C for AF #3 correction limits and 31A84 for #3 AFR Learning I believe. I have tested it and it's worked for me.

Bamofo · **Joined:** Mon Jul 02, 2007 7:46 am **Posts:** 430

hitautomotorsport wrote:

The Lorax wrote:

rozsko wrote:

Thanks for all the info in this thread.
Unfortunately I don't have IDA pro as it is quite expensive compared to what I would use it for, but I was able to check my rom (A8DK100Z - 07 EDM STi) and did a hex search as mentioned earlier.
There are three matches in my rom, and one (the first one) of them was matching with the 07 WRX address mentioned in an earlier post, so I gave it a try. I actually tried all three addresses and fortunately nothing vent wrong. :mrgreen:

So for A8DK100Z it is #029A60 and right after re-flash, AF correction#3 was stuck to 0% from the earlier value of ~-45%.
(of course first I was logging the 16bit ecu version monitor

and that gave me a -50% value, but after some time, I realized there is a 32bit ecu version of the same and that was showing 0%)

Based on td-d's work from here and here

Code:

29A60 AF_3_Correction_Limits_High:.float 0.5
29A64 AF_3_Correction_Limits_Low:.float -0.5

27AE0 AF_3_CL_Target_Compensation_Limits_Low:.float -0.5
27AE4 AF_3_CL_Target_Compensation_Limits_High:.float 0.5

td-d, sent you an email, did you receive it?

Can you please explain how i should include these tables -add what and where ?

Example : 27AE0 AF_3_CL_Target_Compensation_Limits_Low:.float -0.5

Go into your rom in ecu flash
Display incorrect/incomplete tables

Find the table named - AF_3_CL_Target_Compensation_Limits_Low
Right mouse click and edit it - There will be a place for the "location" in this case it is: 27AE0

Hopefully this helps and you can figure the rest out on your own.

diveblues · **Joined:** Fri Nov 02, 2018 12:17 pm **Posts:** 17

Hi,
Could I please get the table for ROM EP5G401Z

h82lose91 · **Joined:** Thu Feb 23, 2012 5:16 pm **Posts:** 36

Anyone have the Comp and Threshold Addresses for 2017 USDM STi AE5W101V

Tried the ones from AE5T110V but get nonsense for values.

Thanks

Bamofo · **Joined:** Mon Jul 02, 2007 7:46 am **Posts:** 430

h82lose91 wrote:

Anyone have the Comp and Threshold Addresses for 2017 USDM STi AE5W101V

Tried the ones from AE5T110V but get nonsense for values.

Thanks

I think AF 3 Correction Limits is @ 39F74
Monitor AF3 see whats up

Bamofo · **Joined:** Mon Jul 02, 2007 7:46 am **Posts:** 430

diveblues wrote:

Hi,
Could I please get the table for ROM EP5G401Z

I want to say its - 33d34

lcthums · **Joined:** Fri Jul 12, 2019 6:38 pm **Posts:** 5

Could anyone help me identify AF3 Correction, Learning and Comp? AZ1G800D, Brazilian (SADM) 2011 WRX

I think AF 3 Correction limits is 0x300b4

ROM Attached

Bamofo · **Joined:** Mon Jul 02, 2007 7:46 am **Posts:** 430

lcthums wrote:

Could anyone help me identify AF3 Correction, Learning and Comp? AZ1G800D, Brazilian (SADM) 2011 WRX

I think AF 3 Correction limits is 0x300b4

ROM Attached

Try 2F608

Report back so i can update my list.

RomRaider

AF#3 (Rear O2 sensor) correction limits

Who is online