NefMoto

I'm looking for a non invasive way to switch between multiple tunes. The hardware is no problem but are there any appropriate signals that I can tap off from within the ECU?

For example,

If I turn on the ignition with brake and clutch depressed = 1  (is there a clutch switch input?)
Turn on with nothing depressed = 2 (default)

but could equally be a single unused data line for serial comms to my board.

Any suggestions?

Cheers,

Carl.

I've thought about this as well.

Clutch, brake, and accelerator pedals, and cruise control buttons are all easily available inside the ECU code.

I've also thought about removing the post cat oxygen sensors and using them.

Pedal values are stored in following variables:
S_bls       Brake light switch
S_brs       Brake pedal switch
S_kupp      Clutch pedal switch
wped_w      Acc. pedal angle (0-100%)
Cruise control switches (if not sent via CAN):
S_fgrat     Off-tip
S_fgrhs     Main switch
S_fgrsv     Set/- switch
S_fgrwb     Reset/+ switch
To locate these variables in your image, do the same as when searching map references:
Locate the code using these variables in an image with maching damos description,
then find the corresponding code in your file, then see what variable addresses your file's code uses.
For ME7.5 you can easily locate the following code with the most useful switches:
 4AE03891       BMOV    [B_dveeson], P2.9
 4AE4384B       BMOV    [S_kl15], P4.4
 4AEA3817       BMOV    [S_ac], P8.1
 4AEA3844       BMOV    [P_ats], P8.4
 4AEA3856       BMOV    [P_swe], P8.5
 4AEA3865       BMOV    [P_crsh], P8.6
 3A6C3838       BMOVN   [S_brs], [cc650_switch_brakepedal]
 D7400602       EXTP    #206h, #1  (81'8000)
 F3F8B815       MOVB    RL4, [CWKRAPP]
 47F8F000       CMPB    RL4, #F0h
 3D04           JMPR    cc_NZ/NE, L_read_values
 DE38           BCLR    [S_kupp]
 AE38           BCLR    [S_fgrwb]
 9E38           BCLR    [S_fgrsv]
 0D06           JMPR    cc_UC, L_continue
L_read_values:
 3A6C386D       BMOVN   [S_kupp], [cc650_switch_clutch]
 4A6C384A       BMOV    [S_fgrwb], [cc650_switch_cc_plus]
 4A6C3859       BMOV    [S_fgrsv], [cc650_switch_cc_minus]
L_continue:
 4A6C381C       BMOV    [S_ko], [cc650_switch_ac_request]
 4A6D3832       BMOV    [B_ldpi], [cc650_reed_switch_leak_diagnosis_pump]
 3A6C382E       BMOVN   [S_tal], [cc650_switch_fuel_tank_reserve]
 DB00           RETS

setzi62, I need hardware signals, although this is good info, thanks.

My Leon doesn't have cruise control switches, so I was thinking this morning maybe the TCS switch. Does this enter the ECU, or does it's actuation cause something obvious to change?

eg. TCS OFF then ignition on = Stage 1 tune (obviously re-enable TCS automatically)
     TCS ON (Default) then ignition on = Stock tune

The other key state change I need is the ignition ON action, can anyone help me find some copper with this signal within the ME7.5?

Great forum this!

Ok, I thought you want to implement some functionality in the code. The term "non invasive way to switch"
was implying to me you want to do it in software  :D.

The TCS information comes via CAN into the CPU and I did not see any evidence that the
TCS-switch is routed to the ME7.

The Ignition switch signal is also called Kl.15, so you can check in your code which port bit on the CPU
gets this signal, in the example it is here:    BMOV    [S_kl15], P4.4

Other hardware signals of switches like brake and clutch pedal are connected to the CC650,
this is a MQFP80-package circuit in the ecu. Maybe you can trace down which pin of this
circuit connects to which switch, seems like there is no documentation about the CC650.

Thanks,

It'd be nice to tap into the CAN bus and just choose an appropriate command, but without an analyser, or any time I've got no hope.


Actually, there's a little plastic breather, maybe I can just use a radio.

Given that I can find the sequence..

 4AE03891       BMOV    [B_dveeson], P2.9
 4AE4384B       BMOV    [S_kl15], P4.4
 4AEA3817       BMOV    [S_ac], P8.1
 4AEA3844       BMOV    [P_ats], P8.4
 4AEA3856       BMOV    [P_swe], P8.5
 4AEA3865       BMOV    [P_crsh], P8.6

within my binary, does it follow that *my* Ignition also enters on P4.4 or is it more complicated?

Cheers!

Yes, if you found this sequence, then your ecu's cpu also gets the ignition signal on pin P4.4

Sorry to bring this up again, but my parts finally arrived...

In our previous discussion, what is "ignition" (P4.4). Is it the 2nd click of the key before start, the position while running?

My question is weather switching back to position 1 will toggle this signal?

The idea is to use this signal to toggle between 2 chip enables.

Thanks.

The "ignition" signal (aka Kl.15)in the ecu is on when you turn the key into run position(2)
and  when you press into start position (3). The signal goes off when you turn back the
key to position 1.
The processor on the ecu will (re)start when going from 1 -> 2 (ignition On).
After turning ignition off (2 -> 1), most ecus will continue to run more or less time
for cleanup actions before shutting down completely.

Perfect info. thank you.

awesome info, thank you setzi