NefMoto

Hi Guys,

I've been playing with med9 for some time and wanted a new project to keep my brain active and also potentially benefit my car in some way.

My idea was to use the intake runner flap pwm output and wire this to a h bridge controller so i can control a water meth pump using the oem ecu. I was thinking of creating a 3d map based on pvdr/nmot_w with the Z axis being duty cycle of pump. Things like IAT could also be used as compensation and even adding feedback to the rear o2 to let you know the tanks empty and switch back to a safer kfzw etc.

But although the idea seems OK in my head i'm struggling to do 1 very important thing and that's locate the variables for these outputs in the stock ram. I've found the pin numbers from the FR after reading the STECK and STEGO section and i believe the PWM output for the flaps is A35 A_T_LBKPWM1 - Then after disassembling the bin i found the variable for the setpoint for flap position which is 7FC39C in my file. This is where i'm struggling as with it being a pwm output this will be configured somewhere in the bin to set the frequency but I've no experience in using or modifying existing outputs to potentially change its operating frequency to suit needs (probably not needed) or actually locate the exact variable i need to control and output my duty cycle too.

I can create the maps and patch the rest in and i'm wanting to share the project to help others but just need that nudge in the right direction to help get the project moving. I have some knowledge of med9 and powerPC disassembly and have done mapswitching, launch control etc so it should be a feasible task.

FYI im not doing this to be 'cheap' its just purely an interest of mine and i like creating things myself if possible.

Hopefully the right people can help - Cheers

Hey mate, I am really intererested in your project. I do some disassembly myself, and I was thinking of using the LBK output to drive injectors . I guess you can find some solution by looking how LDTV works. If you are interrested we could work together.

Hi,

Yes that’s a good idea and I’m sure it’s been done before. Similar to my own project too and I’d definitely be interested in helping! First things first we need to locate the variable and it’s configuration with regards to pwm frequency in the binary. So the whatever gives its final output to A_T_LBKPWM - this could be really simple and it could be the variable I’ve stated but I’m not sure although I will test it and try and see what happens.

If you can find this then I’m sure it will be a big help for both of us.

Can you please share your file, then I’ll be able to disassemble it at home?

Hi, I'll use this file as i have an A2L for it. My car is 115T but I don't have an a2l and things are much easier with one so if we crack it on 115H I will be able to figure out where everything goes on 115T as they're similar.

If you need the A2L for 115H let me know and ill post it.

I have already worked on this file before. But I don’t have the a2l for it. It would be nice if you can send it to me please.

Here's the A2L...

just noticed i posted the wrong .bin it was sw version 0050 not 0010 so didnt line up correctly with the A2L

here's the correct file.

So been doing some work on this and found the PWM signal output is talbks_w and talbk_w (Duty cycle LBK signed and unsigned).

Then also found the H-bridge is a TLE7209 which has a input voltage range of 5-28v and max PWM frequency of 30khz. This would be plenty for our needs although id like to check where this is set in the file and potentially alter it if need be.

So we could alter talbk_w directly as LBK has been disabled in my file (RFD) so if we branch to a free space in ram then use pvdk_w and nmot_w with the output being talbk_w this would effectively be out duty cycle controlled from the ecu? then just some physical wiring to a mosfet so the pwm signal can be used to switch a high current feed without risk of damage to the IC although infinieon rate it at 5A max i think the pump would be around 5.8A but rather be safe than put stress on the ecu h-bridge.

So if the above is correct we just need to figure out how to alter the pwm frequency (to check its sufficiently high enough).

cheers

WMI is best controlled by it's own controller with a failsafe system, which is tied into the ECU.
e.g. the Aquamist HFS-3.

This output could be used for controlling an additional bank of injectors in batch fire mode (probably will need a fast SSR on the output though). So what you are doing is definitely useful, just not for quite the right reason.
For controlling WMI, just buy the correct thing.

To see where that PWM goes in the end, you need to read the processor manual. To see which registers are responsible for the PWM period and duty.

Thanks, just been reading the MPC562 architecture and found some interesting modules on what registers are used to set pulse width and period. So the next question is where are these registers located? the document gives address's of MPWMSM0 Period Register (MPWMSMPERR) @ 0x306000 and MPWMSM0 Pulse Register (MPWMSMPULR) @ 0x306002

The flash is only 2mb so these address if absolute wouldn't be in the .bin but i guess there's an offset added that will send me too the right location? Looking at the memory map shows that MIOS14 is @ 0x00360000 so how do this?

attached is the memory map and other useful documents on the cpu architecture.

Here's the memory map

How could any system register possibly be in the flash?
The answer is: it can't.

These control registers are treated like RAM.
Find where the code writes to them. Maybe they are set up only once at boot and then only the actual value is written etc.

I never did this in MPC562, but I was fully successful at understanding how this works on C167.

Of course my bad! I have read the ram from 7F8000 and 800000 using an arduino and sparkfun so I’ll see if there’s any way I can do similar to read the area I need.

Thanks for the help prj, I’ll update when I make some more progress.

I love this idea. Has anyone ever realized that on MED9 or MED17?

https://youtu.be/pyu9mRy2_uU
https://youtu.be/NzbplAtXeeE
https://youtu.be/XQOCfHp7Tbs

I answer here to the questions asked in mp.
it is enough to modify a pwm function of the ecu to transform it into a pulse function and to make it synchronous with the engine rotation.
then to create a strategy of calculation by using the variables pressure, tension, temperature and to add the special maps for this secondary injection like krkate fkkvs tvub temin...

I understand the strategies to control the injectors but what I’m struggling with is locating the registers which hold the pwm settings. I’ve read the mpc562 architecture and found where the registers should reside but I cannot find them in the ecu. According the ELF file I have the registers are in the textflashbios but again I’m struggling to locate this? Have you done this before? If so any clue on where it is located?

Ill carry on looking and post if I find anything.

Cheers

You're way overthinking it.
I'd do the pulse per two engine rotations.

And also it's enough to do TVUB + a single RL x NMOT map with a factor that gets multiplied by RL.
You're not going to do a full lambda targeting control and mixing anyway. It's too much work for what can be solved much easier.

You may be satisfied with little, but not everyone is.

LOL

Or maybe what's more likely, you don't have any clue what you're talking about here calibration wise :)

IPW = rk_w * Factor + TVUB. RL and through it rk_w are already temperature compensated and target lambda is baked into rk_w. TVUB is nice to have.
For the factor you use a map with same axis as FKKVS for simplicity of tuning.

It can be literally done with 2 maps and the result will be exactly the same as doing it with 20 maps. Especially in this case, where injection is needed only on WOT, as using DI everywhere else is preferable.
More is not always better. It's not exactly voodoo magic, the hardest part for everyone will be to find how to control PWM, but actually it's not so hard if you look at the OEM routines.
I don't get the obsession with this stuff on a pretty much dead platform though...

PWM is maybe even the wrong word for it, all you need is to turn the input on and off in a crank-synchronous interrupt.
Did not look at this on MED9, on ME7 it was possible to do a single fire with a certain duration via configuring the registers.
I did this for WMI control a long time ago, I don't see the big problem about it, I certainly was not as up to speed back then.

http://nefariousmotorsports.com/forum/index.php?topic=19238.0title= (http://nefariousmotorsports.com/forum/index.php?topic=19238.0title=) - this little project with source code reconfigures intake flap to control N75...

absolutely! I don't know what I'm talking about, I think here nobody knows anything and everybody is bad except you!

Discuss the topic, not the person.
You take a jab at someone, then get offended when this is returned. Read what I wrote in previous post and if you have something to add to it, then do so.

Yes remember all we are doing is trying to learn new things/share knowledge, no need to fight.

Let’s get back to the topic and figure the pwm issue.

So we know it needs to run crank sync (easy enough once we find we’re the pwm is controlled), and the maps prj mentioned above would do the trick as far as metering the ipw to ensure smooth running etc.

So now it’s just the pwm period, duty registers that need finding. After reading the mpc562 architecture it seems that these are defined in the mios14 section and are configured at address 0x360000 but this isn’t the address the ecu will use necessarily. After looking through a med9 elf file I found some code for pwm in the text flash bios. So where is this and how can I read/modify it. Once found it’s a case of reading the PowerPC architecture and figuring out what period/frequency to to run depending on the clock speed, this is well defined though so shouldn’t be too big of problem to understand and implement the changes needed.

The project you shared above is great help prj, I’ll have a read and see what you’ve done.

But you don't really need to run a fixed PWM.
You need to enable and disable an output crank sync.

Usually you can configure a PW register to do that for you, you trigger in a crank sync interrupt, and set it up for a certain duration, and make it "single fire", so it does not repeat.
No idea if MPC562 supports a such configuration mode, need to read processor manual for that, which I have no interest of doing anymore for MED9.

I did think it could be done this way after reading your earlier post, I’m sure there’s a section I’ve read in the architecture which supports this as this is pretty much how the pwm outputs are created as they can also be recalibrated to be used as GPIO.

Yep it’s definitely got no monetary value but it’s an interesting project to me non the less. All good skills to develop for future projects when the time comes.

Cheers 

if you don't modulate your rk with ps_w and pbkist you might as well not use tvub, you'll have one less map. even simpler you can also put a switch behind the accelerator pedal and control an injector directly.

ps_w and pbkist_w delta correction is needed if you are using the stock returnless system.
This is three lines of code when written in C.