NefMoto

This post is for someone that likes to experiment into building a simple launch control function using ignition retard on any med17 ecu .Be aware that most of those ecus have an already built in function that you can utilize with various ways including requests from a DSG gearbox.The oem function is using minimum ignition angle maps such a zwlate etc.

Now if you need to force such a function based on some simple conditions to build boost or have some fun here is how :

The code was done on a tc1766 med17.5.5 1.4 tsi engine and it does not need a "free" memory space to function".The hook up is done through zwout_syns and hijacks zwcalcar+array.


--------------------------------------------------------------------------------------------------------------------------------------------------------

PFLASH:8011EDA6 loc_8011EDA6:                           ; CODE XREF: sub_8011ECE4+B6↑j
PFLASH:8011EDA6                 add16           d2, #1
PFLASH:8011EDA8                 movh.a          a2, #@HIS(zwcalcar)
PFLASH:8011EDAC                 extr.u          d2, d2, #0, #8
PFLASH:8011EDB0                 lea             a2, [a2]@LOS(zwcalcar)
PFLASH:8011EDB4                 addsc32.a       a15, a2, d4, #0
PFLASH:8011EDB8                 st16.b          [a15]0, d0
PFLASH:8011EDBA                 jlt.u           d2, #2, loc_8011ED1A
PFLASH:8011EDBE                 j32             loc_80170052    <----------------------Jump to als nls function
PFLASH:8011EDC2 ; ---------------------------------------------------------------------------
PFLASH:8011EDC2
PFLASH:8011EDC2 loc_8011EDC2:                           ; CODE XREF: PFLASH:80170064↓j
PFLASH:8011EDC2                 st32.b          zwkrafld, d3
PFLASH:8011EDC6                 addsc16.a       a15, a2, d15, #0
PFLASH:8011EDC8                 ld16.bu         d15, [a15]0
PFLASH:8011EDCA                 st32.b          zwist, d15
PFLASH:8011EDCE                 st32.b          zwout, d15
PFLASH:8011EDD2                 nor16           d15, #0
PFLASH:8011EDD4                 st32.b          zwoutcpl, d15
PFLASH:8011EDD8                 ld32.bu         d15, zwcalcar
PFLASH:8011EDDC                 st32.b          zwzyl1, d15
PFLASH:8011EDE0                 ret16


--------------------------------------------------------------------------------------------------------------------------------------------------------


Main function for launch control


--------------------------------------------------------------------------------------------------------------------------------------------------------

PFLASH:80170000 alsnls:                                 ; CODE XREF: PFLASH:8017005A↓p
PFLASH:80170000                 ld32.bu         d15, byte_D00000E9 ; b_brems
PFLASH:80170004                 jz32.t          d15:6, locret_80170050
PFLASH:80170008                 movh.a          a15, #@HIS(speed_deactivate)
PFLASH:8017000C                 lea             a15, [a15]@LOS(speed_deactivate)
PFLASH:80170010                 ld16.bu         d15, [a15]0 ; unk_8016FC26
PFLASH:80170012                 ld32.bu         d2, vfzg
PFLASH:80170016                 jge.u           d2, d15, locret_80170050
PFLASH:8017001A                 movh.a          a15, #@HIS(lc_rpm_activation)
PFLASH:8017001E                 lea             a15, [a15]@LOS(lc_rpm_activation)
PFLASH:80170022                 ld.hu           d15, [a15]0 ; unk_8016FC22
PFLASH:80170026                 ld.hu           d2, nmot_w
PFLASH:8017002A                 jlt.u           d2, d15, locret_80170050
PFLASH:8017002E                 mov16           d15, #1
PFLASH:80170030                 movh.a          a15, #@HIS(Lc_retard_degrees)
PFLASH:80170034                 lea             a15, [a15]@LOS(Lc_retard_degrees)
PFLASH:80170038                 movh.a          a2, #@HIS(zwcalcar)
PFLASH:8017003C                 lea             a2, [a2]@LOS(zwcalcar)
PFLASH:80170040                 ld16.bu         d15, [a15]0 ; unk_8016FC20
PFLASH:80170042                 st32.b          [a2](unk_D00024C3 - 0xD00024C0), d15
PFLASH:80170046                 st16.b          [a2], d15
PFLASH:80170048                 st32.b          [a2](unk_D00024C1 - 0xD00024C0), d15
PFLASH:8017004C                 st32.b          [a2](unk_D00024C2 - 0xD00024C0), d15
PFLASH:80170050
PFLASH:80170050 locret_80170050:                        ; CODE XREF: PFLASH:80170004↑j
PFLASH:80170050                                         ; PFLASH:80170016↑j ...
PFLASH:80170050                 ret16
PFLASH:80170052 ; ---------------------------------------------------------------------------
PFLASH:80170052
PFLASH:80170052 loc_80170052:                           ; CODE XREF: sub_8011ECE4+DA↑j
PFLASH:80170052                 ld32.bu         d15, zzylzue
PFLASH:80170056                 svlcx
PFLASH:8017005A                 calla           alsnls
PFLASH:8017005E                 rslcx
PFLASH:80170062                 nop16
PFLASH:80170064                 ja              loc_8011EDC2
PFLASH:80170068 ; ---------------------------------------------------------------------------
PFLASH:80170068                 ret16
PFLASH:8017006A ; ---------------------------------------------------------------------------
PFLASH:8017006A                 nop16


--------------------------------------------------------------------------------------------------------------------------------------------------------

Since my code after several months is now far more advanced and works on several med17 platforms i decided to give something back to the community.
Remember that this code is tc1766 1.4 tsi specific and you might need some minor changes due to some differences on the factory zwout_syns and due to some silicon bugs that involve rslcx , ja , calla etc...

Once you understand the function you can brake it up and call the main function directly from the raster but that will require a non used memory address for triggering which might take you a while to figure out.

Questions regarding this post can be done here and NOT in PM..

+1 thanks for this.

amazing! Good work! haxor as fuck.

Thumbs up for you

Very nice! Med17 is not simple ecu. Good work!

I'm sorry for the stupid question, but what architecture is this? What are these instructions?
I'm just a Computer Science guy digging his way into tuning..

Its assembly in Infineon.

tricore ref https://www.infineon.com/dgdl/tc_v131_instructionset_v138.pdf?fileId=db3a304412b407950112b409b6dd0352

so i'm looking through my a2l for the med 17.9.8 and it looks like it has all the the necessary functions from within the code however i haven't the foggiest clue how to start about implementing it if i posted a stock file would you be able to take a gander been trying to find someone to do LC and NLS on it for a while.


I've currently gotten boost building LC by the guide from nefmoto and a lc that has louder bangs both work well on stock turbos but i'm currently dealing with a larger turbo (bnr s5 on a 1.6T) and even setting it up for 4700 it's like ... no boost for you .

i think i have a rough idea of how your code works but i would appreciate any assistance you can give

lol nice first post

All the assistance you need is around this forum.

I have basically given the code to build whatever boost you need if you know what you are doing. This code is VAG based and most likely will not work on other platforms that has a different ignition array.

I have not studied the code of your ecu yet and unless i have a full read or a good complete hex-a2l pair i might never do it too..

Also half of your post does not make sense.

sorry thought i made a first post long ago when i originally joined sorry

I do have a hex a2l pair already which is how I have been developing the my tunes for the car ( this forum was WAY more helpful than just dealing with what ecm titanium gave when i first started tuning them lol ). You mentioned it doesn't need "free" memory space to function so i figured the process was different the other things I had found on here. I tried searching before posting but for whatever reason i don't have luck with the search function ( i literally searched for med17 as i was trying to find the precontrol thread and it told me nothing existed LOL)

What part doesn't make sense ? i've already followed the nefwiki for how to have a simple launch control  ( not hard cut ) which works to get like 4-5 psi on our stock turbo .. a more rambunctious one that got to 7-10 on stock turbo no issue. but when swapping to a much larger turbo they do nothing to build boost even having it setup at 4700 rpms which is where the turbo spools

Apart from an a2l and hex a test car is needed and that should be local.

Bottom line is unless i decide to post more things here everything else will be a paid service.This one also means that it has to become a priority for me and i don`t see the potential gain from doing this in one car.

I've go through the tircore manual "tc_v131_instructionset_v138" but dont find the meaning of "[a2](unk_D00024C3 - 0xD00024C0)", would anyone like to give a hint? ;)

Start from the basics.... Load your own med17 file with ida ..study the original code and try to identify the variables/functions etc...after a while you will understand what this is as you will see that multiple times on the original code.

After some months come back on this thread and read it again.There is no reason to expect a full understanding of what any line does unless you spent some time with ida and a random full med17 readout...

Bringing this back from the dead.

I'm currently writing a LC for my ME17, i successfully cut spark at desired RPM(with changing dwell output). It doesn't always refer to the dwell table while sitting on launch RPM and seems to push past the desired launch RPM. My ECM calls a couple functions from SPRAM for outputting coil triggers, and i haven't figured out how those functions get copied to SPRAM yet so i can't follow them to see what exactly they do and or see the ECM trigger the coil's(they do it over SPI to a seperate IC inside the ECM).

So i'm investigating doing launch by changing timing. How far are you retarding/advancing timing, my ECM limits timing to 54 degrees of advance but i can set LC timing after that check. Timing on my ECM is set in an 8-bit signed int, so the max i can advance is 127 degrees. My though is to advance so far that the spark plug sparks before any fuel is injected, causing a spark cut essentially. is this correct thinking? 127 BTDC is still after fuel is injected.

Is my thinking correct, or am i way left field on this?

Thanks.

There are multiple ways to cut spark. study ignition fade bits on the fr...

The way you are trying to do it i assume is through szouthom_w but you probably missed something before that.

On some sw versions you have to see also that there is the stratified output and temp values for dwell times.

Hijack it properly and it will work...

As far as the retardation goes..Its simple, study the internal combustion engine and you will know :)

Thank you for the reply. I don't have a fr to go off of, this is all just by studying the ecm.

Yes, i followed the Dwell table (Batt V / RPM) and found the address in RAM that is stored with the table output, that gets multiplied by 3 and then that gets read into a core special function register within the function. Is the stratified output within the same function possibly?

I believe i found the calculation for dwell temp output, but it gets bypassed by a bit in the configuration area.

Edit: I looked a little deeper. Hooked up an oscilloscope to the coil trigger wire. Set dwell to 0 and fed the ecm a simulated crank trigger. Found when setting dwell to 0, it still pulled coil trigger wire to low and instantly back. Found where it called a function that passed the coil dwell time to a register and set/bypassed that and now it does not pull the coil control low. Thanks for the help.

Reviving an old one. First, not knowing German does not really help digging the information out from FR (that's the only FR I have for MED17). We are working with ME17.3.0 and cutting spark through szout_w hijacking, still trying different values for the best result (yes, I know 0 is not a good idea), but I would like to find a cleaner way, as leaving something in szout_w does not cut the spark fully and the effect is not as pleasing as it could be. So any more hint (variable name?) on how to cut spark better would be appreciated.

Second, back to the first post (thanks for that info BTW). Is there anything fundamentally wrong with introducing the retard through hijacking zwgruhom? Apart from the obvious limitation by all ZWMN maps on the way to zwcalcar. Again, we got it to work like this, but I am still after improving the code and perhaps I have not yet hit any use cases where zwgruhom would not do what I would like it to do.

There are plenty of ways to approach this.The "right way" is to build your own table, put it into a function that uses zwmin and then trigger it based on a condition.

As far as ignition Cut goes there are also 2-3 ways to do it...Again the somehow "Right way" is the ignition fade in/out function while "forcing" an overrun condition as ignition fade in/out functions are triggering fuel cut.You could also make certain functions disregard fuel cut while you are on LC.

That said it would be good to set one more table for boost control and make sure that the functions you are hijacking are disabling misfire recognition otherwise you will have to do it yourself.

Setting a manual value to Szout_w is not always a bad idea and mostly depends on the coil type. Some immo functions on bosch ecus are inducing fuel and ignition cut so you could study that as well.

BTW fuel cut is just for show. I use retard via zwout_syns (or syncs0 ) function and hlsdem on newer vag based cars to achieve such results for rolling launch or launch control.

https://www.youtube.com/watch?v=4zjhuW_C4nM

With only hlsdem it still closed throttle... unless you make hlsdem always cut, but that's not always desirable.

When I was doing rolling antilag a while ago, I did the following:
1. Hijack zwout based on a map, which gets activated delta rpm before target.
2. Set a different hlsdem target.
3. Introduce a map with delta RPM to target and the output being how many cylinders to fade out. This way you have a soft rolling fadeout mask also.

This is closest to the OEM launch control on S18 and MED17.1.62...
Lets you build as much boost as you want while still being soft.

Thanks for all the pointers. I got most of what you said, the problem is that the ignition fade in/out procedures are total mystery to me. I did disable misfire detection and knock detection (just to be safe) "manually", so these should not be a problem. And there is a WG duty cycle control on top of things too (essentially the code is a complete mirror of what I have done for ME7.9.10 some years ago and posted somewhere here). Just that ME17 is more stubborn it seems.

So for now I am sticking with reducing szout_w, but now I also forcefully reset fubaanz to 0 when cutting spark. As for ZW, I moved from zwgruhom to your way posted here, there was a problem with this though, on ME17 zwcalcar has a complement array for monitoring (did not see this in your listing), so both of them have to be modified. Long story short, most optimal way was to do it "slightly" elsewhere than you did it to avoid hooking up in two places in a contrived way. If this works, I will post some details here for future generations ;) I am not the tester of this, so now I have to wait for the next results.

As for the "soft" solution, the "kids" want to be really loud it seems (and then collect pieces of their engines from the ground, but that's not my concern), the client is always right... ;)

You don't need to disable anything if you use the correct way to fade out cylinders.

Find this and analyze it "ignFadeStatBits_w"

it was right a few years ago. Google Translate really translates these days)

I do not doubt the quality of the translation, just that copying and pasting it piece by piece is a bit of pain... Anyhow, now I got my hands on the actual FRs for the ECU I am working with, and in the right language too.

Came across this, but also many other things with suggestive names. Thanks for putting me on some track ;) In the process also discovered there is this B_koevab business, which at first sounded like exactly what I would need, but then it cuts everything, including the throttle, so not what I need I guess.

OK, this seems easier than I thought (or I am totally wrong), there are dedicated functions I can call to turn the ignition off and on, for all cylinders or selectively. So another direct question, I know that you know what I mean, which one of these patterns will work the best:


I do not want to test all of them, my money would go on CYLCUTOFF or DMDZAG.

I have been studying the FRs and sources for almost two straight days now, I still can't figure out how the ignition fade-out request is coupled with the injection cut-off  ???

So I know already that I got the ignition fade out/in calls right, so that was piece of cake, thanks again! However, bypassing the fuel cut was so far very unsuccessful, my first attempt (by temporarily bypassing a small branch where B_bevab is set to true along with a couple of other things) resulted not only in the fuel still being cut, but also never coming back, or maybe not even that, perhaps the monitoring system did not like the configuration of the variables and shut down the engine, fuel cut or not. So 50% solution so far (with one pending test that can potentially solve the issue, but my guts tell me it won't).

EDIT: Looking at the actual code for DMDZAG tells me with very little doubt that the ignition cut and injection cut are requested separately, so I am not sure that the statement that ignition fade-out pulls in fuel cut automatically is actually true. I am not at the car during the tests to check this either, so I am still a bit lost.

EDIT 2: And the same conclusion looking at the immobilizer related cuts...

EDIT 3: the ignition / fuel not coming back in one of the attempts was a stupid coding mistake on my side. It all slowly clarifies now.

I've been studying this thread while reading the FR for a long time now, happy to see fresh posts. Hopefully if you've gotten this to work reliably you could share a few more pointers, people like me who are learning greatly appreciate it. I'm new to tricore and Ida so it'll take me a while.

Since just now I came to this, if somebody else would need this in the future, this is how I explained it to myself:

This is the array of zwcalcar.
If zwcalcar_0=0xD00024C0, then zwcalcar_1=0xD00024C1, zwcalcar_2=0xD00024C2, zwcalcar_3=D00024C3.
The parenthesys (unk_D00024C3-unk_D00024C0)=0x3, means the 3rd byte of the array, after zwcalcar_0, i.e. zwcalcar_3.
It is like writing st32.b    [a2]0x3, d15, depending on the version of the disassembler one might use.

just to clarify - it looks like this simple ign cut launch control function from the first post needs to be used along with transmission launch control. I.e., I don't see how this function would hold the rpms steady once the lc rpms are reached. I assume the transmission lc control needs to do that, correct?
So to implement the lc without doing anything to the trans software (say, if you have a manual trans or just don't want to go into it), something else is needed to hold the engine rpm at the lc rpms. Is it where the hlsdem comes into play? I.e., hijacking the torque reserve system so that the engine can't get past the launch rpms even at 100% throttle?
There was another example of MED 17.5 CCZB lc somewhere on this forum which uses MDMAXNMOT for that, but my ECU neither has MDMAXNMOT, nor LDRXN etc.

to me it looks not like ignition cut, but forcing 0degKW ignition angle in the ignition angle array.

If you read carefully you will see that ignition "Cut" comes from a different function hence the "ignFadeStatBits_w" . Further more hlsdem is different from software version to software version.There are plenty of ways to do this job and newer ecus have functions that you can use by hijacking some conditions.

I think this is a second approach, i..e., using ign cut func from DMDZAG etc. I'm talking about your first post which shows how to hijack zwcalcar, it's not clear to me what's holding the rpms at the launch point in that case. My ecu is about the same vintage as MED17.5, it's a MEVD17.2

right, looks like they write some predefined value to zwist, zwout and zwoutcpl (complement), not reallt touching the zwcalcar