NefMoto

After alot of hard work, my map switching routine is finished (functionally). I wrote it completely from scratch without referring to anyone elses work and the functionality is mainly dictated by the limited amount of ways that the driver has to communicate with the ECU. The routine is completely dynamic, bug free, and IMO very clean and efficient.

As it sits right now, maps can be switched by pressing the "Set" button on the cruise control stalk and the current map can be displayed without switching maps by pulling the "Res" switch. Both functions work anytime the ECU has power: ignition on, engine running, and while driving. The selected map is communicated to the driver by the EPC light and the MIL light, but I will likely stick with just the MIL because it is easier to see. I'll save the EPC light for something else as I have alot of ideas swirling around. I have other prospects for displaying the selected map, but I already had the MIL and EPC working and I wanted to just get it finished up. I will try some of the others once everything completely finished.

Currently, I have only incorporated KRKTE, KFZW(2), and LDRXN in order to ensure that the functionality is perfect, but I plan to add LAMFA, KFLBTS, and KFLAMKRL. My main motivation to write this routine was because I am considering moving to an E85 setup. There are currently four sets of maps and the original maps are ignored. Four sets seems to be overkill though and I am considering moving to just three because it takes alot of space having four sets of the larger tables  (KFZW, KFLBTS). I chose not to include KFMIRL for this reason and figured that LDRXN should be enough.

The purpose of this thread is to gauge some decisions on what the community would like.

What would be practical activation conditions for switching maps? For displaying selected map?
   I originally limited switching maps to B_st  = false (during start) and B_stend = false (start end), basically engine not running. I have it unrestricted right now, but am thinking of limiting switching maps to only during idle and engine off. I have one trick up my sleeve, but I may save it for something else as well.

What maps would you want to be included?

How many sets of maps is enough? Three? Four? Less? More?

The routine is written for M box and L box B5 S4 ECU's, but shouldn't be hard to adapt to others.

Another thing that I have been struggling with is how freely I want to release this. I am pretty sure that I will not release the source code. I think that I may share only by request to members that actively contribute to this forum (at my discrection...we all know who).  My sole purpose here is for the advancement of the platform and I feel wrong even thinking like this, but I have my reasons.  Or I was thinking of just posting stock files with the routine implemented along with an XDF.

What do you guys think?

******************************************************************************************

The attached files are for personal use only. I have implemented some security features in these files, so if you tamper with things that you shouldn't and your car doesn't start you know why.

I have attached a stock L and M box for B5 S4's. I have only tested these stock files on the bench because I don't even have my car at the moment, but I have been running this code on my car for a few weeks.

Maps can be switched by pressing the "Set" button on the cruise control stalk only while the car isn't moving (basically) and the current map can be displayed without switching maps by pulling the "Res" switch anytime. The selected map is communicated by flashing MIL and EPCL.

Knock light flashes MIL and EPCL 3 times if wkrma (average ignition retard) exceeds WKRMA_IND (in XDF).

There are four maps sets, with the first being the original. The attached XDF contains all of the map sets including maps:
KRKTE
KFZW(2)
KFLBTS
KFLAMKRL
LAMFA
LDRXN

I just threw these stock files together today, so let me know if anything doesn't function perfectly.

 I currently have my map switching utilizing 2 sets of maps as more just seems to be unnecessary. I developed mine for the same reason...E85.

My maps include:
KRKTE
KFZW
KFZW2
KFLBTS

and I use the MIL to display the map group selection.

Seems to cover me pretty well and give me the ability to do a quick switch over between 93 and E85. I was having issues with switching maps with the car running from time to time, but really haven't messed with it lately (get about 5 seconds and the car would die).

Anyways, that's where mine currently sits and I feel like it has plenty of functionality. IMO I think you should limit the release of this code.

Great work as always man!

Hey, Philla_dot!
I would say that TWO versions of maps are enough, most of people would switch it between E85 and regular gas anyway.
Main maps would be:
KRKTE
KVB
KFZW
KFZW2
FKSTT(0A,1A,2A...)
KFFWL (0A,1A,2A...)

I just switch KFZW, KFZW2, LDRXN, FKKVS off of my meth failsafe automatically.
If the system is on or a fault condition is present, it runs the pump fuel maps. If it is injecting and all parameters are good (flow, level) then it runs the meth maps.

I use the rear O2 input for the failsafe signal from the meth kit.

imo 3 sets should be enough..
one ECO-fuel(91oct), one normal(93oct) and one e85.
..or could be; ECO, WINTER, SUMMER.

KRKTE (main fueling)
KVB (for instrument correction)
KFZW, KFZW2 (main timing)
LDRXN, LDRXNZK (main boost)
KFPED (needed to adjust pedal-sensitivity after adding 8-12deg timing on e85)
FKSTT_0A,1A,2A...(needed for cold-starts on e85)
KFFWL_0A,1A,2A...(needed for e85 warmup)
KFZWWLRL (ignition retard based on engine temp, for e85 smoothness in cold weather)


thats my 2c.. glad to see you working on this, it is a very usefull feature, good work, keep it up! :)

Thanks for the replies so far.

I am thinking that I will eventually move to three sets, 93 oct, flex fuel, and straight E85. Or maybe keep it at four and have E85 summer and E85 winter.

All of the E85 fun will have to wait until I can get a set of injectors and a fuel pump though.

I will start a thread on flex fuel if/when I make some progress on it. The hard part will be the scaling factor.

You guys running E85 are not adjusting target Lambda from traditional 91/93 oct?

What about activation conditions?

Without limiting activation conditions, cruise control cannot be utilized because this would cause a switch to the next set of maps.

Is engine off and at idle good enough?

I have one trick that doesn't interfere with driving in any way, but I may save it for something special.

imo, this works perfect, as you will be switching maps in standstill after refueling, for most part.




im running E85 and a bit leaner in lower loads, and at full load im running ~12.5ish, while at 93oct im running ~12.2, so i think its definitely close enough.. having to add all fueling maps for different strategies would take alot of space.
im also using a method for lean-burn.. might be interesting to implement, but could be an idea, as running ~15.4 afr on e85 seems to produce the best economy on cruise.

would just using offsets for some maps work instead of using full maps?

i.e. adding 8* to output of KFZW instead of a separate KFZW map?

This is far from optimal.

You're basically describing preset Lemmi settings on the fly.

The routine is already done and there is enough space to accomodate the maps.

a quick mathematical surface model would be able to do what was suggested above.  i agree with el rey, less is sometimes better.  i really like where this thread is going.  this is a legit move in the right direction.  cheers phila dot.

how much unused free space is on the default m-box.  how about the m-box that has the programmed ALS/NLS?
we need to hear from RS4Boost on this, he probably knows off hand - and has programmed many custom routines with his own work on the K-box + WINols (?)

Badass!

Since this is going to be used for switching between fuels, how hard would it be to add a visual indicator for knock? Say for mixed fuels or incorrect map selection?
Maybe something similar to the cel flash for misfire, but flash both lights if knock cor goes above a few degrees.

There is tons of free space.
There is no problem with it even on 29F400 ECU's.

There's plenty of room within reason.

There's more than 3,600 bytes where I placed my maps, but there is a good amount of unused locations.

KFMIRL for example is 444 bytes, so four sets would be 1776 bytes!

If I was really concerned about space I could include the original maps as well.

My function is compatible with the NLS/ALS function. I don't use any of the same memory space.

Good idea. It wouldn't be hard to implement.

What's a good threshold, > 5*?

I guess I could use a user configurable constant.

Knock light is indeed a good idea. Could be as simple as - if wkrm > x degrees, MIL ON, else MIL OFF.

Yeah, I was thinking about flashing the number of degrees retarded or maybe try getting the it in the fuel consumption display.

It would have to be obvious that it's not misfires though. Maybe use the EPC for this one.

I think if your car is so slow that you have time to count the amount of times the CEL flashes while flooring it, then you have other problems  ;D

It wouldn't really work anyway because wkrm will be constantly updated, so how would you determine when to grab it.

My car is pretty slow though.

I think turning it on when wkrm reaches a certain threshold and then turning it off again will be perfectly fine as a "knock light".

Frankly, it's more of a novelty feature than anything - you should have safeguards in place in your tune, so that things don't go boom with excessive knock retard.

Agreed for the most part.

Currently, when I'm not logging, I can tell when I have high ignition retard by watching AFR. If I enrich past target, then I assume that it is due to ignition angle efficiency. It would be nice to have confirmation.

Ah totally forgot, you should probably think about including kfzwmnst. I had to tweak mine quite a bit between 93 and E85 for start up. The values I use for E85 brought start up in under a crank and up to 4 cranks with 93.

UPDATE

Major changes:
Utilized the orginal map locations for map set 1 (PITA...still 4 total map sets)
Limited the map switch function to not driving
Knock light - 3 MIL flashes when wkrma exceeds configurable parameter threshold

Maps implemented so far:
KRKTE
KFZW(2)
LDRXN
KFLBTS
KFLAMKRL
LAMFA

awesome news, great progress.

been a while since I've been on here (obviously I no longer have a personal car to play with, and my time is being used else where) but this is great stuff, then again you've always were good at contributing here.

Glad to see this place is still producing some awesome knowledge!

Kudos

Might be interested to implement map switching the following way: http://www.youtube.com/watch?v=8IddRNFb22o
Getting feedback of the map # based on the RPM. Looks nice.

That's Rick off here map switching, very nice way of showing map selection

I played around with this a little bit, but I wanted to be able to display the selected map anytime without interfering with driving situations.

It is a clean solution though...

Nice work Rick!

Thanks man.

I've got alot more coming.

How's the E36 coming along? You'll be back...

Wow, I need to check this section more often. Awesome work! My input, I say keep at least 4 sets, as it might be nice to have a 'kill mode' map (ie more than one map for a given fuel, or possibly a map if you decide to turn on nitrous or something).  A 'valet mode' would be a nice feature (even if it didn't need to utilize its own set of maps, but maybe just limit nmot to 3000RPM or something).  For conditions, I vote to be able to change while moving (could be useful for the kill mode or nitrous example above), maybe have it with pedal angle 0 or something, as you can just let off the gas to change the map and when you actually want to use the cruise control functionality, you are most likely going to be giving it some steady throttle as you hit set.

Stock files with the routine implemented and XDF are attached to the first post.

AWESOME work!

I haven't looked at the xdf yet, but is there a place to adjust how many maps should be used?

No, but that is a really good idea and it would take almost nothing to add.

You mean if you are only actually utilizing two map sets, have it only switch those two instead of having to flip through all four?

Nice work about map switching, but why so complicated?
I think 2 files enough and this you can do with a 29F800 (original 29F400), no additional code is required and there are two separate files for tuning.

Next I think the fire at the gear changes is not the best for the engine because of high temperatures.
Regards
Chris

And what do you do if you already have 29F800?
Also, enjoy having random car no-start and EEPROM corruption if you switch this on the fly and get unlucky, because checksums are calculated continuously.
Not to mention soldering all kind of crap in the ECU...

Yea exactly.

Thanks for sharing phila!

When I convert to e85 I would love to have map switching, one for pump gas winter mode, one for e85 and one "limp" for inspection :)

Thanks for the awesome work as always Phila_dot.
I'm going to be switching over to this with the Lambda Mono changes that we have been talking about...

Now onto the 5120 changes ;-)

Havent check your work but i appreciate your time and knowledge.

Switched over to this today. Good work man!
I haven't got anything different in my other 3 tables yet though, I wanted to confirm it worked ok first ;-)

Now I can have a Valet mode :-D

Thank you very much for sharing your work. I just flashed my car with your map switcher with my stage 1, 2 and 2+ maps and they all work great. major pops to you man.  8)  I like the fact that you can switch maps on the fly that will come in handy for sure. thanks again.

This is awesome! Can you (or anyone) please include the ALS/NLS to the base files (or separate files)?
9

It's pretty easy to do by comparing to a file with it.
Personally I stopped using the ALS... I am only using the soft launch.

I use holding set with gas off to decrease cruise speed :/

for condition, i vote clutch pedal depressed (if moving)... which generally turns off cruise anyway.

this thread makes me want to sell the volvo :-\

i wish i could use something like this but good job phila, if i could i would definitely contribute more, but i am still learning!

I've been playing around with this for about a month.  It already works this way.  If you are moving but the clutch is depressed, you can change maps.  If the clutch is engaged, the CC will work as expected. 

This is dependent on the clutch pedal switch working properly.

Good stuff!

Great work!

Maybe making an xdf with all know functions, and multimaping functions and maps is a great idea... all in one place..

But this is a step forward to this forum ... a great work for sure

Amazing work!!!!!!!!!!

krkte on xdf have conversion factor wrong right?

as the axis for all maps invert¿

Yes, KRKTE conversion is wrong. I chopped up an old xdf real quick when I posted. Thanks for the reminder.

Map axis are correct.

maybe y use a old xdf

many thanks for your work, if you go here in spain y pay you a beer or twoo jjajajja

Here's the XDF I put together for comprehensive tuning using the multi-map features.  I started with the M20120516 version of the M-box XDF and made a separate category tree for the extra maps that this bin provides.  Each are labeled m2-m4 for "map 2-4."  All of the stock maps are still in their original categories and they represent m1.

I made the axes of the extra maps match the original XDF for easier cut/paste and I also put the KRKTE factor to 0.000111.

I hope this is useful to others. 

Tested and work really well....

Can sameone help me to make als nls work on this bin...

Y tried put the jump and code from 002 mbox bit wont work

Many thanks

That one is pretty old.

i am keeping updated versions here

http://nyet.org/cars/files/defs/

also, I will be doing a big update soon

I did not even realize that!
Awesome!

I'm going to be switching back to the map switching here.

For those who care about consumption display there is one error in KVA 41.40 in phila_dots 551M binary in OP.

0x8bf17 should be $F2 NOT $F4

I don't think there should be any risk of division by zero or anything like that but consumption in cluster will not work correctly.

Yea, this was first noted by savageS4 and then confirmed by New2tune.

That's what happens when you throw things together quickly and copy and past the code for the three KRKTE locations without paying attention.

I've been meaning to update, but I just haven't had time.

Has anyone tried to adapt this into another ecu?

By a quick look Phila_dot is using the following in the mbox

FD86.2 s_fgrsv
FD86.3 S_fgrwb
FD22.0 B_mil
FD22.1 ----

The rest addresses i found i can assume that it is empty spaces that you are loading your own functions

Like

FDF2.5
FD70.6
FDB0.1
FD4E.11
FD9A.13

ALso i understood the security impimentation on the end of the code.

Also the link in routine is at 0x5fa70 Da8890e4

and wkrma in memory 0x00f9b3

the rest addresses are pointing to the file.

But my main question is if someone has used that to another ecu and if this code works fine.

How hard would it be to add FKKVS to the list of switchable maps?

why do you need FKKVS in map switching?

Well I am running a mix of E85 and 91 gas, and I use FKKVS to dial in the fueling, and the values are different when I'm running just straight pump gas vs when I'm running the mix.

after a while of the anti-lag script and 2step i think that together with the community we were able to make it works fine on some ecus, with some more work could be possible on this also, just i need something like the pdf that sn00k did with the antilag stuff for better understanding and generate line by line the assembly code without mistakes. but this time i have a jetta for test so i will release it at least working with a car.. i hope.

well if a pdf was made i am sure that a lot of people could do that...Anyway I respect Phila_dot`s work and i would`nt like to say anything more about his code since i am still trying to figure out some changes that are outside of the code but i have a complete understanding of what is going on.

If he aproves we can start sharing but i think that there was a reason that he didn`t like that from the start.

KRKTE is the best choice as the KRKTE formula calculation includes the fuel specs!
changing in the formula the fuel specs you are getting a new KRKTE value for the same injectors with different fuel as E85 or racing fuels with different stoich AFR etc!

FYI for anyone running this code and wishing to use the NLS and Launch Control the address for the 001 version of code is not the same as the 002.
Use 0x8B39C for the JumptoALNLS for 001 M-Box
Use 0x8B3A6 for the JumptoALNLS for 002 M-Box

How do you guys handle cold start when switching from E85 to 93? I mean 600% more fuel on cold start MAPs with E85 base tune might wet the plugs even with correct KRKTE for 93?

Phila, awesome work. Just wanted to say thank you on top of all the others who appreciate your time.


May be a stupid question, but when you say a big update what would you be updating? Defining more maps in the XDF? Descriptions?

The contributors to this site are seriously talented people with this stuff... I appreciate even just reading it!

No, mostly fixing a bunch of errors that people have reported over the past few months. i've been really busy so i haven't had the time to do regular updates/bugfixes

It would be great to have the cold start maps switchable as well as mentioned.  As running e85 and 91 or 93 yields different cold start and warm up maps.

hello, I don't get it. where is the code to be able to test it or to transfer it to other ecus?

Reply #52 I would imagine, It's an XDF file which you will need to finalize with your ECU's Box code I imagine.

I myself like this threads information and intention.

Would there be a way, to setup the the multiple maps as follows?

1. Stock
2. 91/93 octane tuned
3. 91/93 octane tuned (with LC and NLS)

Also, how did some of you adjust the map switching to display via REV counter instead of cruise control?

Lastly, would there be a way to perform map switching via another method instead of CC (cruise control)?
As I don't have cruise, only just started looking into gathering required parts to retro fit.

Thanks for all the info in this thread so far, most helpful indeed.

1. Yes
2. Yes
3. Switching the call to code would be trickier, require re-writing the routine.

About the cruise, sure. If you look a little, someone posted a routine (undone) that used pedal position to switch maps, so yes, it is possible.

At that point, you might as well start from scratch.

between 91 and 93 i'm not sure it is that important to have separate maps.

you can use KR based fueling, and you're gtg.

Spoken like someone that has not experienced the joys of 93.

:P

Thanks for the info, I imagined map 2 and 3 would be tricky.
So having the Rev display and pedal map switch, you recommend starting from scratch or new topic of discussion?

I'm still trying to get my head around what I require to be able to tune my own ECU. Also seeing I have D_Box code, it seems like a very uncommon box code. Therefore I have no Idea yet to change say a M_Box code into a D_Box code.


Not sure if you where referencing to me? I was just using the 91/93 as examples. Either 91 or 93, not both.
Thanks for a lot of the info provided to tho forum. It seems you have help many members out.

If you are having trouble with basic tuning, dont bother with map switching code yet.


There is no good reason to stay with a dbox (I'm assuming this is for an s4?)


Sorry, I misunderstood your post, was thinking you wanted stock/91/93 not stock or 91/93 :)

Well Done Phila!  :)

Hero status for sure

This is the 1st time I am going to try this map switching out and make a .bin for my car.

I have a few questions. Now I start with the base L-Box file listed in the 1st/OP and add in my Stage 2++ data and when I need to add in the few things I need to make a "STOCK/BASE" file I then would open up my normal XDF that I use for tuning and copy of my changes for MAF, SAI Removal, Brake Booster Delete, Evap Delete, 2.0T FSI Coils, Rear 02 delete and Left foot braking.

Is that how it would work? So I'd set up this L-Box base as a stock L-Box with my required tweaks and then open it with the map switching XDF and then port over my Stage 2++ settings correct?

Also, is there any other posts on this that have more info that I might have missed out on. I just happened to see/stumble onto this in the Show unread posts since last visit section.

Audiman85, I will try to answer all of your questions from your post and email below.

Just tune the file as any other.

The original map locations are map set 1 and are the default any time RAM is cleared. Tune alternate versions in sets 2, 3, and 4.

The first post explains everything. I know it may be confusing, but anything above the line that isn't addressed below it most likely remained the same.

I do have a version that allows setting the number of maps to switch, but I didn't release it because I felt that it was only really necessary for commercial applications. So yes, if you only want to use two, then you would want to make three identical sets and one alternate and you would have to cycle through all of them.

The current map set is indicated with CEL and EPCL blinks.

To switch maps you push the set button on the end of the cruise stalk anytime that the vehicle is below 3km/hr (iirc) or if the clutch pedal is pressed. The CEL and EPCL will flash to show you the newly selected map set. To check the currently selected map set without switching, just slide the res switch on the cruise stalk. Cruise control still functions as normal.

I have completely rewritten this code and intregrated all new functionality including dynamic NLS/ALS, but it isn't done testing and my car is down at the moment.

For everyone asking about porting to other ECU's:
This code is much more complex than the simple ALS/NLS function on here and therefore more difficult to port to other files. Outside of RAM and data dependencies, it is also dependent on the original code that it interects with. I have noticed that the same map will be addressed differently among software versions and would require this code to be changed slightly.

I'm not going down this route just yet. Been working at APR for almost 5 years now in my region.
So I have all their tools at my disposal. But I read on the forum there tools should not be used?

So will use my Vag-tacho and Vag K +can commander and KKL cable to play with ECU.
Still trying to find spare ECU thou, which I can play with.


Correct, on my own S4. Why would you recommend I change to a different box code?
At this stage, I would like to keep my IMMO intact and working. I do realize I can transfer the immo data over to another box code.
Hoping to try and at least extract my ECU coding in the next day or two.

Then I can try and compare the code changes to schnell's Stage 2 tune.
Also getting LC or at least NLS activated with EGR delete. May or may not remove secondary Oxy sensors as well.


No problem. I know that my posts don't always make sense. Just getting to excited to interacting with like minded folk and learning more.
Hopefully resulting in assisting others as well.

Phila_dot, thank you for answering my questions. My goal is just to run a stock tune and a stage 2++ but from what I see this is ment mostly for just fuel switching from the defined maps in the xdf? Am I correct?

If I'm wrong maybe someone explain to me how to do it. I don't have a reason to use different grades of fuel really as 93 is only thing available in my area. Its all I ever run regardless of stock or my stage 2++ tune. I plan on on ordering a w/m kit this week, not as nice as the stage 3 dvc-30 kit (Devils Own) I used in my last car and plan to run it full time and never without washer fluid on hand and if I don't I won't be beating on it while empty.

Like I said in my email sometimes I enjoy flashing back to stock just for the lower boost, get to rev the car out and get to hear the car more cause we all know on Stage 2+ we would be up to 100 mph in no time and that don't allow you to hear the joys of the exhaust or engine for long b4 you hit illegal speeds.

But great work bro, even if I don't use it that was great work! I added to your karma! Thanks again for answering my questions. Sorry I emailed ya too. I get excited about new cool features.

It can do exactly what you are asking.

Use stock LDRXN and adjust enrichment and timing as you see fit in one map set.

Ok, I got it now. I was thinking backwards I think. I was thinking make the file a stock file and the map select my stage 2 maps. But I think I understand now, make the main file my stage 2 and a select-able map my stock mapping or for me m2-m4 (since I only want 2 maps)? Correct?

Gonna make a file and try it out. Thanks phila_dot, think I'm just confused from lack of sleep the past few nights, got a lot on my plate right now.

***Edit/Update*** it can be either way stock or stage 2 file and maps can be changed to either, I see now where I was getting confused.

I got it now. Thanks, about to test file here in a few minutes

Ok, I am stuck at KLFAMKRL

My axis are different, can someone tell me what I need to do. Attached below are screenshots, 1 from Phila_Dot's L-box switch-map file and my tuned stage 2++ file.

KFLAMKRL and KFLAMKR share SRL06GKUB @ 0x18292

Ok everything is working great on the test drive!!!! Now my question is my incredible gas mileage.... I must have switched to a hybrid engine with this flash cause 1/4 tank is 175 miles distance and my avg mpg is 200! So what I am I missing here lol??

That is the bug described a few pages back.

Change F4 to F2 at 0x8BF17 and correct checksums.

I need to correct the files in the OP.

I could post up two files a M-Box and L-box with the fuel comsumption correction and a short video I made on the map switching feature if this is OK wit phila_dot?

I'll correct the ones in the OP and embed your video. The XDF has a bad factor for KRKTE as well that needs to be fixed.

Sounds good bro.

And I am now setup to use all 4 selections. I have decided selection 1 as stock, selection 2 for stage 2 90 oct, 3rd for 93oct and 4th for when I tune for the meth kit in the following weeks. Thanks again this was a great find, can't believe I have been on here almost 3 years and just stumbled across this now lol..  ;D

This is awesome, will it work with med 9.1?

Would it be possible to create an auto-injector like the one in this thread?: http://nefariousmotorsports.com/forum/index.php?topic=3349.0title= (http://nefariousmotorsports.com/forum/index.php?topic=3349.0title=)

I'd be willing to help however I could. I understand if you don't want that though, phila.

yes some stuff for 1.8t users would be very helpful
i was tryed 032HN map switching file  but MIL light flashes randomly when switching between 5 maps nah

Quick question Phila_dot... did you ever correct the main files?

I already made the F2 myself but was wondering about the calculations you said where wrong for KRKTE. I went back to using this map switching program now that my meth kit is here.

The factor is wrong for KRKTE in the xdf, it just needs to be changed to 0.00011111125.

The file except is good except that one bug that you already corrected. I'll fix this next time I'm on my computer.

Here's the "repaired" xdf krkte changed to 0.000111 * X

sorry phila_dot if I intervened  :-[

is it possible to store the selected map to eeprom? In order to have the selection persistent.
br cruuz

c167 is mirroring values from eeprom in RAM (for example before you turn off engine adaptation blocks are copied to eeprom from RAM).
You have to refer to SSCCON block in IDA

So i am trying to port this code to the 1.8T in my Cupra BAM with sw number 362999

So far i came up with the following..


s4 code uses the following functions i matched them with ida with my own.

     S4                           Cupra

FD86.2 : S_fgrsv        FD6C.12
FDF2.5 :            FDD2.5
FD86.3  : S_fgrwb          FD6C.13
FD22.0 : B_Mil        FD24.0
Fd22.1  : Ecpl             FD24.1
FDB0.1   : B_stend         FD9A.1
FD4E.11 :           FD44.6
FD9A.13 B_st        FD84.7
byte_F9B3 : wkrma     byte_F9D5

I think i also found all the calls for krkte - lamfa etc and figured out the way that Philadot is calculating the address table.
I also found out that there is not enough space for all the mapsets in the same memory location that is free on all s4 me7 but my main problem is that when i press the set button ecu seems to reboot while car is working..stalling for 1 sec and then is back up again...Is there any difference in the memory stack that causes this problem ? how can i figure out what is causing this since if i am logged with me7logger the session stops also..

Has anyone else tried to port this code to his own 1.8T ?

for switch the map without use the speed regulator button on a non equipped s4 b5 can i add an extra switch to the pin of the ecu ?
what ecu pin need to be connected ?

Hi guys,

I have t two tunes that Daz did for me , one for petrol and one for E85. Can somebody help me merging the two together? Feel free to PM

What is that have to do with the multimap thread? Moreover i find offensive the use of ddillinger's name to ask for help.do you see anyone giving out for free that kind of service?sorry if i am beeing rude but search the forum as all the info is here...Philadot has a code released for that and you did not even bother to check...Use the search button on the forum.

I wouldn't even waste my time with a response.

Hi.

If you still need it - I can do that for you, but it won't be free. What car do you have?
Can you flash/log the car on your own? Are you familiar with bootmode flashing?

I have also a Cupra 225 BAM i'm new here and new about ecu tuning... have you found some info about this car? have you a xdf file? any advice?  :)

LULZ

Is there a memory location (or set of locations) I can access via logging that shows the active value(s) for things that get re-mapped in this bin?

For example, if I can read one or more of the currently active LDRXN values (and these are different between map sets) then I can programmatically detect which map set is currently active.

I've been away for a while but I'm finally swapping my Green Giant injectors for EV14s and I'm revisiting this multi-map file. I've been using it happily for a few years now!  :-)

Thanks for any help or info anyone can provide!

Edit: removed a comment about using xdf memory locations because I realized the difference between offsets in the bin file and actual RAM locations. :-)

I tried to do some RAM dumps using my old python code but I'm running in to some issues (mainly do to with having little-to-no idea what I'm doing).  :-)

I haven't found LDRXN maps copied straight in to RAM anywhere yet but I also can't seem to access all of RAM yet, either. Can someone confirm that I'm at least looking for something that should exist?  Or do I need some IDA Pro wizardry to even have a shot at this?

Really what I'm looking for is the ability to log the RAM location that tells the MIL how many times to blink.  in a perfect world, there's also a place to write a byte (or a few) directly and change maps bypassing the whole check for 0mph/clutch/stalk selector.

I'd be happy just to know the selected map set in my logs, though. Anyone out there know if this is theoretically possible with this bin?

Thanks!

try 0x383F42, I think this was the ram location for map number in Mbox. Don't know if Philadot has used different locations on different files. You can add this adress to me7logger and make sure to set offset to 0 and factor to 1

Thanks!  I'm using an M box anyway so all good there.  On my bench rig this address returns a value of 1, so far so good.  My car is somewhat taken apart at the moment so as soon as I get it up to to point where I can do map selection, I'll give this a test. 

Any idea if there's a RAM location(s) to write to (with checksums, I assume) from a KWP2000 session that causes all the maps to adjust accordingly?  I imagine there's a place in Phila_dot's routine that can be poked. 

My thinking is along the lines of:  With an embedded computer, the car can watch for things like empty water/meth reservoir and back off to a safer tune. Or simply allow the user to do map set changes from a GUI instead of the stalk. 

Again, I'm very happy for the above info!  Thanks again for your help!

The switching routine is just using a batch of preset values in ram that point to the corresponding maps, the function is switched by conditions like clutch + cruise switch. If you are thinking about embedding some gui you should be more than capable of writing your own routines. I wouldnt know how to write to ram by just using kpw protocols, this would be much more complex than actual coding changes like these map switching functions. I am sure that if you really grasp how this would be done, you would not have asked for a simple ram adress that is easy to locate in a disassembly. No hard feelings  :) for as far as implementing your idea: just writing 0,1or 2 to 0x383F42 should be sufficient to have all the maps switch over to the corresponding set. In my opinion it is easier to write these safety monitoring functions you suggest in this actual ecu by using voltage signals. No need for external computers at all and you can keep full switching functionality aside from safety maps.

Understood on all counts. I don't have IDA Pro and I haven't found another way to do dissembly without it. Plus it's been a long time since I've done any assembly code (6502!) I'd probably be able to hack my way through it but since I'm just an amateur, I have a hard time justifying 20% the cost of my car just for hacking. :-) 

Instead, I'm going the other way. I'm limiting myself to what I can do externally with Python. The GUI I'm talking about would be hosted on an external device. Think of something like a OBD tester but with persistent logging and some extra features to help with tuning, etc.  I'm using a Raspberry Pi as my platform with a small touchscreen.

I've been running this multi-map bin for a few years so I want to integrate with it's capabilities.  I already have some code that reads and writes to the ECU over KWP so it's the old, "when all you have is a hammer, everything looks like a nail."

I'm sure there are many other, better ways to accomplish what I'm trying but I'm having fun so I'm happy. If I come up with anything cool, I'll share.

Thanks again for sharing all the great info!

I'll respond here when I have a moment

the part with a possibility writing ram with kwp2000 very interesting for me

I don't want to hijack this thread.  I was mainly looking for ways to interact with the custom multi-map features Phila_dot added, like reading the map set number.  Even just this has value to me when logging persistently. 

Let's take the KWP2000 stuff over to the "Communication Protocols" sub or take a look at this thread in Data Logging: http://nefariousmotorsports.com/forum/index.php?topic=4212.0title= (http://nefariousmotorsports.com/forum/index.php?topic=4212.0title=)  There's Python code there that exposes some of the basic KWP read/write stuff.  (Only tested on my M-box and generally buggy.)  It's not a substitute for disassembly (easier to spell right on PC vs phone!) in any way, much more important for logging. 

For what it's worth, I was able to directly read and write values to 0x383f42 (via KWP) and that value stayed persistent after a power cycle.  Even though my rinky-dink code wrote and returned the values 0x1, 0x2 and 0x3, for some reason when I use my logger on the same address, I'm getting 16, 32, and 48 instead.  Any known reason why this would happen or am I just losing a nibble somewhere in my code?  Can't confirm that maps are changing on my bench rig (or I haven't figured out a way yet) so more results to follow.

Looks like either your logger or your "writer" are off by 4 bits. (It's a word var, by the way). Should not stay between power cycles as well.
Also (not sure here, going from memory) it really has to go through the "switch" section of code manually to compute new map addresses. So (if you absolutely want to make it this way) you're better off just emulating cruise stalk action by KWP.

Shouldn't be too difficult.

All you would need is a very basic function that monitors the contents of the ram address and jumps to the right location in the map switching routine any time the value changes. You would also have to change one jump in the map switching routine to avoid an infinte loop.

I'll get you the specifics when I get the chance, but it should really only take a few bytes of code.

Why not
http://nefariousmotorsports.com/forum/index.php?topic=2349.0
to be able to easily view which set is active? Or did I miss something in trichard3000's wish?

Well actually I think he is more interested in switching the maps from a kpw comm. I can see how cool this can be when you are using some kind of touchscreen in your car to select driving modes.

well then using can-bus messages would be better way to do that

This is the kind of functionality I was hoping was already "in there" or at least could be hacked to work by poking at the routines by writing one or more set of memory locations directly.  If this isn't workable, I'm fine because my main goal was to be able to read the mapset in use, more than write it.


I'm also trying to keep this all working over the typical, blue logging cable.  Without digging back in to the wiring diagrams, I don't think my B5 has CAN-BUS at the OBD connector.  KWP can be used over K-line as well as CAN-BUS so if it's low-level ECU stuff, I may not need CAN-BUS. 


My bug.  :-)

Can you do this to an med 9.1 audi s3? 2.0tfsi?


Sent from my iPhone using Tapatalk

the whole mapswitch stuff is completly after the normal stuff where in a normal bin only is FF in hex editor right?

so if i transfer everthing to my M box bin, the mapswitch works should also work in there?  i use a M box bin in a 2000 eu spec a6 ajk with s4 agb cams and bosch maf so i propably cant use the bin attached in here?

Map switching routine is after the normal stuff yes, but it is also referenced in the main code to the new routine. If you just copy and paste the routine , you literally just have the routine at the end of the bin, may as well put in "stairway to heaven" lyrics in there instead for all the good it will do. You also need to make sure you find the reference point in the main map and copy the hex for that and any other parts referenced elsewhere. If you know what you are doing then sure copy and paste will work but if you don't then without IDA pro you have a hard task.

then i definitly cant do that.. maybe somebody could help me with that?

is there a simple way to make make 3 or 2 maps only? or does it all need to be done in ram variables?

On it :P

But yea, the routine needs to be referenced or it's not going to do anything

Hi,

Someone could make me multimap for this 1.820vt me7.5 polo file, with pedal combination. (has no crusher control)

Is it reasonable to use the HEX parts of this code on a 7.1.1 file? I think disassembly is beyond my scope at the moment.

Do not blindly copy/paste anything. Period.

I understand that aspect, i also didn't say anything about blindly copying.

How would one apply the map switching routines to other .bins, I guess would be a more appropriate question.

Good afternoon, thank this forum for the great information that there is reverse engineering.

I am doing my map switching, I can find several maps well, but problems to find the KFZW in the address 812120.

Searching and comparing several projects I found the code that refers to the KFZW, but I don't understand the "mov r13, # 311Ah"
For me it would have to be "mov r13, # 204h"

204 * 4000 = 810000
810000 + (r12 value) = 812120

311Ah is the rl_w axis of the kfzw 0x1311A obviously
its the short addressing method for the maps stored in 204 205 segs
and thats why you cannot simply create a new kfzw maps outside

math routine (0x78B8) should be also moved and changed to respect new segment addressing

Is there a way to move the map to the end of the file?
I understand that R12 is the beginning of the map, r13 is axis, r14 and 15 are the variables of each axis.

If I just modify r12 to the new address, will it work?

yes

only if you place new map(s) in 204 205 segments (if you can find a free space there  :))
OR
in the ram area 380000-384000 iirc
i didnt try the second option imo its a more complex way to solve this

Thank you, I will look for a place in 204 205 segmens

Enviado desde mi MI 9 mediante Tapatalk

hi guys!
Can anyone give me some advices or links to help me with transfering this to the 1.8T AMK?
Don't do this for me, just let me read smth. :)

I want to do this in AMK too but its a long way and I didnt have Ida pro for now.
Unfortunately there isnt a description of function in bin file so hard to find what we need change directly in bin file.

I start to diassemble code from m box ori and with map change and compare.
Please tell me what mean if in ori we have for ex. :
mov     r12, #0F28h
mov     r13, #206h

and in mod file is changed for :

mov     r12, word_BF62
mov     r13, word_BF6A

I want to understand how it work and how to read this.

It seems ORI code point to a fixed address (in flash) and MOD code point to a ram address whose content can be modified dinamically elsewhere so you get an effective address switching method. IMHO.

Haven't really thrown a single second looking at it on IDA, but from the snippet you posted... this is my assumption.

Regards,

Did anyone ever patch this multi-map routine into the 002 version of the M-Box bin?  Looking to combine these features with the 5120 hacked bin and I'm worried about potential differences between 001 and 002.

Thanks!