Lemmiwinks

What is Lemmiwinks?
Named after an infamous Southpark character, lemmiwinks gives the average person access to a few parameters used by the Bosch Motronic ME7.1 to make engine management control decisions. While it does not allow the user to directly modify the internal boost/fueling/timing maps, let alone the control code responsible for interpreting those maps, it does allow quite a bit of customization.

Of most interest, it allows quite a bit of control over fueling, which, in the case of the B5 S4, is probably the single most important parameter when using a larger turbo than stock.

Of secondary interest is its ability to change the overall timing maps. However, ME7.1's built-in knock sensor control loop somewhat limits the usefulness of this feature.

In addition, Lemmiwinks allows changes to the speed limiter, parameters governing engine idle characteristics, and "specified load" scaling. This last function is unfortunately also of limited use. Even though target load is directly related to specified boost, the default value is 100%, so target load (and therefore boost) can only be scaled downwards, not upwards. However, reducing overall boost can help prevent excessive negative boost deviation which can cause throttle cut.

How lemmiwinks works
Directly transferring the new adaptation channel values into the ECU works by finding the RAM memory location where the ECU stores the adaptation channel data and directly writing the changes to those RAM memory locations. When the ignition key is turned off the ECU enters a housekeeping mode where among other tasks the modified adaptation channel data is written into the serial eeprom. This roundabout method is required because memory writes directly to the serial eeprom are blocked.

Interestingly, this method will not work using the VAG mode protocol. Write access is allowed to any ECU RAM location except those locations that store the serial eeprom data. Someone at Bosch clearly knew about this vulnerability and took measures to close this loophole. But for some reason this loophole was left in the KWP2000 routines.

Each ECU code stores this adaptation channel data in different RAM locations. To make this method work with any ECU one runs through the following steps:
 * 1) Establish communications with the ECU using KWP2000 mode
 * 2) Read data directly from serial eeprom (since read access is allowed)
 * 3) Search for this data in the ECU's RAM
 * 4) Write the new adaptation channel settings to the RAM location
 * 5) Cycle ignition key to have ECU transfer the new settings into the serial eeprom.

The KWP2000 protocol is not as reliable as the VAG protocol. Some cars will have communications problems which often can be worked around by pulling the instrument cluster fuse (make sure VAG-COM will be able to clear your air bag DTC light before doing this!).