NefMoto

This is intended for a development thread.  None of the files in this thread should be used and are for development only.  If this gets fully developed a final file will be in a new thread. 

All of whats below is untested, unproven, and if you do anything with it it is at your own risk.

So, I believe that I have written a full on anti-lag launch control and no lift shift for the 551M box.  I also just about have one written for the CH-Box.  All Im missing is the edit to the CH-Box for the read of KFZWMN.  On the M-Box theres only one location, but on the CH-Box theres two versions that I believe are controlled by soft coding.  Locations are at 0x81230C and 0x8123CC.  Can anybody help me out with the disassembly to find that map?  Ive attached the last edit before adding antilag.

Also, because this is in the tuning sections, Im posting the M-Box antilag.  The version commonly available on here only cuts spark dwell time.  I raise a flag for the conditions being correct for different conditions for the system to become active.  The engine must be within a temperature range, right now 80* to 105*.  CWALS must be set to whatever you want to enable.  For launch control, the clutch must be depressed, the vehicle must be under 3 kmh, and the engine speed must be above the rev limit (4500).  For no lift shift, launch control must not be active, clutch engaged, brake not engaged,  engine speed above threshold and pedal above threshold. 

If the flags for ALS become active, the system can be configured to run on a second set of tables for LAMFAW, KFLBTS, KFZW, KFZW2, KFZWMN, and KFZWMS.  I have set these to delay spark until 20* ATDV, and enrich the mixture.  KFLBTS is unedited, but I could see enough reason to write it in to put it there.

NONE OF THIS HAS BEEN FIELD TESTED AND LOGGED!!!  File is using Bosch Maf!  putting this out there to get feedback and a little help.  Suggestions on modifications are all welcome.  Tests and video hopefully coming soon.

Well done, I will take a look time permitting.

Does it disable misfire and knock detection during spark cut?

Also I have edited the topic to note which ECU it is for.

it disables knock recognition.  it doesnt touch misfires yet.

i have the disassembled 1.8 file if it will save you any work.

Hi. I have problems with 551M file.
I have no connetction with ECU after flashing.
I tryed MPPS, bootmode without success.

Has anyone else tried this file?

That was a terrible idea. I sticked this so experienced people could look over the file before flashing it anywhere.

What on earth were you thinking? For all you know, that file could cause permanent damage.

Thanks, I will wait for testing..
My ECU works fine after flashing original file

When I saw this yesterday I had a couple of grim remarks in mind, one of them asking whether it has been at least test flashed to check for software traps and bricking. Clearly not, and I should have done that after all. Only I did not want to be discouraging, I developed a similar thing and it takes effort and confidence to publish something like this.

And then following this - if you post untested binary patches, it might be helpful to post your assembly changes in human readable form. Sorry to say this - it's neither tested, nor readable, what do you expect anyone of us to do with it?

I was hoping an IDA project would be included as well

Understood.  This was by no means meant to be flashed to anyones equipment and further development is needed.  I will get the IDA posted shortly.

VERY HAPPY to see if unstickied.

Found a few issues.  For one, had an error in my xdf that led to an incorrect byte change.  Then I found a bit out of place that turned a movbz into an add.  Have corrected issues.  Disassembly reads:

ROM:0088E490 AL_routine:                             ; CODE XREF: sub_85FA48:hijack_1P
ROM:0088E490                 bmov    S_cruise.2, word_FDF2.5   (code replaced by call)
ROM:0088E494                 extp    #0E0h, #1 ; 'a'
ROM:0088E498                 movb    rl4, tmotlin      (tmotlin-0x380BC5)
ROM:0088E49C                 exts    #81h, #1 ; 'ü'
ROM:0088E4A0                 movb    rh4, AL_maxtemp      (AL_maxtemp-0x817120)
ROM:0088E4A4                 cmpb    rl4, rh4
ROM:0088E4A6                 jmpr    cc_C, B_als_reset
ROM:0088E4A8                 exts    #81h, #1 ; 'ü'
ROM:0088E4AC                 movb    rh4, AL_mintemp      (AL_mintemp-0x817121)
ROM:0088E4B0                 cmpb    rl4, rh4
ROM:0088E4B2                 jmpr    cc_NC, B_als_reset
ROM:0088E4B4
ROM:0088E4B4 LC_set:
ROM:0088E4B4                 movb    rl4, CWALS         (CWALS-0x817122)
ROM:0088E4B8                 jnb     r4.0, lc_reset
ROM:0088E4BC                 jnb     br_cl_cond.8, lc_reset   (0xFD56.8)
ROM:0088E4C0                 extp    #0E0h, #1 ; 'a'
ROM:0088E4C4                 mov     r4, vfil_w         (vfil_w-0x380E40)
ROM:0088E4C8                 exts    #81h, #1 ; 'ü'
ROM:0088E4CC                 mov     r9, lc_veh_speed      (lc_veh_speed-0x817124)
ROM:0088E4D0                 cmp     r4, r9
ROM:0088E4D2                 jmpr    cc_NC, lc_reset
ROM:0088E4D4                 mov     r4, nmot_w         (nmot_w-0xF87A)
ROM:0088E4D8                 exts    #81h, #1 ; 'ü'
ROM:0088E4DC                 mov     r9, lc_rev_limit      (lc_rev_limit-0x817126)
ROM:0088E4E0                 cmp     r4, r9
ROM:0088E4E2                 jmpr    cc_ULE, lc_reset
ROM:0088E4E4                 extp    #0E0h, #1 ; 'a'
ROM:0088E4E8                 movb    rl4, B_alsflags      (B_alsflags-0x383F40)
ROM:0088E4EC                 bset    r4.0
ROM:0088E4EE                 extp    #0E0h, #1 ; 'a'
ROM:0088E4F2                 movb    B_alsflags, rl4
ROM:0088E4F6                 jmpr    cc_UC, B_nls_set
ROM:0088E4F8 ; ---------------------------------------------------------------------------
ROM:0088E4F8
ROM:0088E4F8 lc_reset:                               ; CODE XREF: AL_routine+28j
ROM:0088E4F8                                         ; AL_routine+2Cj ...
ROM:0088E4F8                 extp    #0E0h, #1 ; 'a'
ROM:0088E4FC                 movb    rl4, B_alsflags
ROM:0088E500                 bclr    r4.0
ROM:0088E502                 extp    #0E0h, #1 ; 'a'
ROM:0088E506                 movb    B_alsflags, rl4
ROM:0088E50A                 jmpr    cc_UC, B_nls_set
ROM:0088E50C ; ---------------------------------------------------------------------------
ROM:0088E50C
ROM:0088E50C B_als_reset:                            ; CODE XREF: AL_routine+16j
ROM:0088E50C                                         ; AL_routine+22j
ROM:0088E50C                 extp    #0E0h, #1 ; 'a'
ROM:0088E510                 mov     B_alsflags, ZEROS
ROM:0088E514                 jmpr    cc_UC, Offset_switch
ROM:0088E516 ; ---------------------------------------------------------------------------
ROM:0088E516
ROM:0088E516 B_nls_set:                              ; CODE XREF: AL_routine+66j
ROM:0088E516                                         ; AL_routine+7Aj
ROM:0088E516                 extp    #0E0h, #1 ; 'a'
ROM:0088E51A                 movb    rl4, B_alsflags
ROM:0088E51E                 jb      r4.0, B_nls_reset
ROM:0088E522                 movb    rl4, CWALS
ROM:0088E526                 jnb     r4.1, B_nls_reset
ROM:0088E52A                 jnb     br_cl_cond.8, B_nls_reset
ROM:0088E52E                 jb      br_cl_cond.4, B_nls_reset
ROM:0088E532                 mov     r4, nmot_w
ROM:0088E536                 exts    #81h, #1 ; 'ü'
ROM:0088E53A                 mov     r9, nls_rpm         (nls_rpm-0x817128)
ROM:0088E53E                 cmp     r4, r9
ROM:0088E540                 jmpr    cc_ULE, B_nls_reset
ROM:0088E542                 extp    #0E0h, #1 ; 'a'
ROM:0088E546                 movbz   r4, wped            (wped-0x380B02)
ROM:0088E54A                 exts    #81h, #1 ; 'ü'
ROM:0088E54E                 movbz   r9, nls_ped_thresh         (nls_ped_thresh-0x81712A)
ROM:0088E552                 cmp     r4, r9
ROM:0088E554                 jmpr    cc_ULE, B_nls_reset
ROM:0088E556                 extp    #0E0h, #1 ; 'a'
ROM:0088E55A                 movb    rl4, B_alsflags
ROM:0088E55E                 bset    r4.1
ROM:0088E560                 extp    #0E0h, #1 ; 'a'
ROM:0088E564                 movb    B_alsflags, rl4
ROM:0088E568                 jmpr    cc_UC, Offset_switch
ROM:0088E56A ; ---------------------------------------------------------------------------
ROM:0088E56A
ROM:0088E56A B_nls_reset:                            ; CODE XREF: AL_routine+8Ej
ROM:0088E56A                                         ; AL_routine+96j ...
ROM:0088E56A                 extp    #0E0h, #1 ; 'a'
ROM:0088E56E                 movb    rl4, B_alsflags
ROM:0088E572                 bclr    r4.1
ROM:0088E574                 extp    #0E0h, #1 ; 'a'
ROM:0088E578                 movb    B_alsflags, rl4
ROM:0088E57C                 jmpr    cc_UC, Offset_switch

Then I have some open space for edits and revisions, Then the maps switches read

ROM:0088E5EA Offset_switch:                          ; CODE XREF: AL_routine+84j
ROM:0088E5EA                                         ; AL_routine+D8j ...
ROM:0088E5EA                 extp    #0E0h, #1 ; 'a'
ROM:0088E5EE                 movb    rl4, B_alsflags
ROM:0088E5F2                 cmpb    rl4, #0
ROM:0088E5F6                 jmpr    cc_UGT, als_offset
ROM:0088E5F8
ROM:0088E5F8 stock_offset:
ROM:0088E5F8                 mov     r4, #1C72h
ROM:0088E5FC                 extp    #0E0h, #1 ; 'a'
ROM:0088E600                 mov     KFZW_offset, r4      (0x383F42)
ROM:0088E604                 mov     r4, #1D32h
ROM:0088E608                 extp    #0E0h, #1 ; 'a'
ROM:0088E60C                 mov     KFZW2_offset, r4      (0x383F44)
ROM:0088E610                 mov     r4, #38Eh
ROM:0088E614                 extp    #0E0h, #1 ; 'a'
ROM:0088E618                 mov     LAMFA_offset, r4      (0x383F46)
ROM:0088E61C                 mov     r4, #1207h
ROM:0088E620                 extp    #0E0h, #1 ; 'a'
ROM:0088E624                 mov     KFLBTS_offset, r4      (0x383F48)
ROM:0088E628                 mov     r4, #6B2Bh
ROM:0088E62C                 extp    #0E0h, #1 ; 'a'
ROM:0088E630                 mov     KFZWMN_offset, r4      (0x383F4A)
ROM:0088E634                 mov     r4, #10B0h
ROM:0088E638                 extp    #0E0h, #1 ; 'a'
ROM:0088E63C                 mov     KFZWMS_offset, r4      (0x383F4C)
ROM:0088E640                 jmpr    cc_UC, return
ROM:0088E642 ; ---------------------------------------------------------------------------
ROM:0088E642
ROM:0088E642 als_offset:                             ; CODE XREF: AL_routine+166j
ROM:0088E642                 mov     r4, #7130h
ROM:0088E646                 extp    #0E0h, #1 ; 'a'
ROM:0088E64A                 mov     KFZW_offset, r4
ROM:0088E64E                 mov     r4, #71F0h
ROM:0088E652                 extp    #0E0h, #1 ; 'a'
ROM:0088E656                 mov     KFZW2_offset, r4
ROM:0088E65A                 mov     r4, #72B0h
ROM:0088E65E                 extp    #0E0h, #1 ; 'a'
ROM:0088E662                 mov     LAMFA_offset, r4
ROM:0088E666                 mov     r4, #7450h
ROM:0088E66A                 extp    #0E0h, #1 ; 'a'
ROM:0088E66E                 mov     KFLBTS_offset, r4
ROM:0088E672                 mov     r4, #7310h
ROM:0088E676                 extp    #0E0h, #1 ; 'a'
ROM:0088E67A                 mov     KFZWMN_offset, r4
ROM:0088E67E                 mov     r4, #73D0h
ROM:0088E682                 extp    #0E0h, #1 ; 'a'
ROM:0088E686                 mov     KFZWMS_offset, r4
ROM:0088E68A                 jmpr    cc_UC, return
ROM:0088E68C ; ---------------------------------------------------------------------------
ROM:0088E68C
ROM:0088E68C return:                                 ; CODE XREF: AL_routine+1B0j
ROM:0088E68C                                         ; AL_routine+1FAj
ROM:0088E68C                 jmps    85h, loc_85FA74

I would not choose to do a full map switch for this function, that is unneccesary. You can hack into zwout for ignition angle and ftek_w for fuel enrichment (I wrote almost a copy paste function for this some time ago > http://nefariousmotorsports.com/forum/index.php?topic=14030.0title= )
I wrote a similar style map lookup for ignition retard that gets planted right at the zwout inputs.

well i stickied it in the hopes of discussion, not freeloaders :/

I started this thread after reading through all of the sticky thread for the revised launch control in the reverse engineering section.  It seemed like something that was really good was developed, and then never released.  Everything Ive learned Ive learned from this forum, and I want to give back.  Dont have a problem with people using anything, and I will put it on here when its done, but I dont want people thinking Im an authority when Im really a novice.

I want to do the full map switch because I feel like I have more things I want to make, and implementing a map switch seems more useful later.  It also gives me more data points to tune. 

ok.  I always say if i stare at a problem long enough I will solve it, and I think i have it.  I believe I have found KFZWMN on my 1.8t file.  I have been using the fully defined 518F file as a guide to building my own xdf.  I have found several issues with it, primarily in the axis calls.  I have also been cross referencing off of the CB BAM file.  I believe the 518F file has the wrong location for KFZWMN.  It explains why overrun fueling never worked.  The 551M file references KFZWMN as follows:
ROM:0088AAC0 loc_88AAC0:                             ; CODE XREF: sub_88AA20+66j
ROM:0088AAC0                                         ; sub_88AA20+70j
ROM:0088AAC0                 movbz   r4, rl
ROM:0088AAC4                 mov     [-r0], r4
ROM:0088AAC6                 movbz   r4, nmot
ROM:0088AACA                 mov     [-r0], r4
ROM:0088AACC                 mov     r4, KFZWMN_offset        <-------------
ROM:0088AAD0                 mov     [-r0], r4
ROM:0088AAD2                 movbz   r12, byte_816B0A
ROM:0088AAD6                 mov     r13, #6B0Ch
ROM:0088AADA                 movbz   r14, byte_816B0B
ROM:0088AADE                 mov     r15, #6B1Ch
ROM:0088AAE2                 calls   0, sub_7B7A
ROM:0088AAE6                 add     r0, #6
ROM:0088AAE8                 movb    byte_380D9B, rl4

writing to a RAM location 2 bytes before zwmnms. 

I crossreferenced the location 2 bytes before zwmnms and saw this

ROM:0089D3F2 loc_89D3F2:                             ; CODE XREF: sub_89D356+26j
ROM:0089D3F2                                         ; sub_89D356+94j ...
ROM:0089D3F2                 jnb     word_FD6E.3, loc_89D42C
ROM:0089D3F6                 movbz   r4, byte_8122F8
ROM:0089D3FA                 and     r4, #1
ROM:0089D3FC                 jmpr    cc_Z, loc_89D42C
ROM:0089D3FE                 movbz   r4, rl
ROM:0089D402                 mov     [-r0], r4
ROM:0089D404                 movbz   r4, nmot
ROM:0089D408                 mov     [-r0], r4
ROM:0089D40A                 mov     r4, #6DCCh      <--------------------
ROM:0089D40E                 mov     [-r0], r4
ROM:0089D410                 movbz   r12, unk_816DAE
ROM:0089D414                 mov     r13, #6DB0h
ROM:0089D418                 movbz   r14, unk_816DAF
ROM:0089D41C                 mov     r15, #6DC0h
ROM:0089D420                 calls   0, sub_7B7A
ROM:0089D424                 add     r0, #6
ROM:0089D426                 movb    byte_380B93, rl4
ROM:0089D42A                 jmpr    cc_UC, loc_89D44A

So I pulled up the 0x816DCC in the CH file and compared it to the BAM file and the table size and axes work and the data makes sense within the table and roughly matches the BAM data.

Do I have it?

Well, that is entirely up to you. My advice is to not make it more complex than needed. Do you need the full KFZW and KFZW2 map for launch control? Do you need KFZWMN?
Do you need KFLBTS and LAMFA? If you want to achieve retarded ignition and have the ability to write your own patch, it makes much more sense to add your patch at the very end of the calculation. This ensures it will not be affected by any other ME7 functionality. ZWOUT is the actual output angle to the coils, you can make a nice custom map if you like (and definitely more handy to have it NOT load based but something more predictable like 3D rpm * pedal or just 2D rpm).
Same goes for fuel, if you want to have it follow lambda (how do you predict what mrfa or rl values will be during launch conditions?) you might as well just use LAMFA. The lowest lambda value will be the result anyway. My personal preference (also based on how most standalone ecu's do this) was to make it a percentual increase of fuel. You could also force a lambda value if you want that, or a fixed injector opening time. I was unsure about lambda control during launch conditions and if it remains closed loop, so I decided not to alter any lambda based strategy but essentially patch the injector size (by giving a final multiplicative correction) while setting my own axis parameters. Again I want to point out that the axis variables of all your changed maps are not designed for this function you want them to control, so why not customize them to your needs?

Ok.  I see what you're saying.  Make it as simple as writing a constant value for zwout when flags are active.  Zwout is written in 3 locations.  Make the write a call to a subroutine that writes a constant for antilag or preserves the function and then returns to the next line.  Leave all the ignition tables alone, and leave the map switch active for just lamfa and make a rich request.  Quick, simple, done.

You can even place the constant in the 1st to make it easily editable.

Ok.  Revisions have been made to follow the recommendations from TinjCU.  Once flags are set, it returns.  Then subroutines are called that are flag dependent that either copy the original code or insert constant values for zwout, lamfaw_w, and B_kr. 

Flag Setting Routine
ROM:008A3ACC ALS_Coding:                             ; CODE XREF: sub_86FB9C+3EP
ROM:008A3ACC                 bmov    S_cruise.6, word_FDD6.5
ROM:008A3AD0
ROM:008A3AD0 B_ALS_Set:
ROM:008A3AD0                 extp    #0E1h, #1 ; 'ß'
ROM:008A3AD4                 movb    rl4, tmotlin
ROM:008A3AD8                 exts    #81h, #1 ; 'ü'
ROM:008A3ADC                 movb    rh4, AL_MaxTemp
ROM:008A3AE0                 cmpb    rl4, rh4
ROM:008A3AE2                 jmpr    cc_UGT, B_als_reset
ROM:008A3AE4                 exts    #81h, #1 ; 'ü'
ROM:008A3AE8                 movb    rh4, AL_MinTemp
ROM:008A3AEC                 cmpb    rl4, rh4
ROM:008A3AEE                 jmpr    cc_ULE, B_als_reset
ROM:008A3AF0
ROM:008A3AF0 LC_SetRoutine:
ROM:008A3AF0                 movb    rl4, CWALS
ROM:008A3AF4                 jnb     r4.0, B_LC_reset
ROM:008A3AF8                 jnb     Cl_Br_Pos_Cond.13, B_LC_reset
ROM:008A3AFC                 mov     r4, vfil_w
ROM:008A3B00                 exts    #81h, #1 ; 'ü'
ROM:008A3B04                 mov     r9, ALSpdThresh
ROM:008A3B08                 cmp     r4, r9
ROM:008A3B0A                 jmpr    cc_NC, B_LC_reset
ROM:008A3B0C                 mov     r4, nmot_w
ROM:008A3B10                 exts    #81h, #1 ; 'ü'
ROM:008A3B14                 mov     r9, LaunchRPM
ROM:008A3B18                 cmp     r4, r9
ROM:008A3B1A                 jmpr    cc_ULE, B_LC_reset
ROM:008A3B1C                 extp    #0E0h, #1 ; 'a'
ROM:008A3B20                 movb    rl4, B_alsflags
ROM:008A3B24                 bset    r4.0
ROM:008A3B26                 extp    #0E0h, #1 ; 'a'
ROM:008A3B2A                 movb    B_alsflags, rl4
ROM:008A3B2E                 jmpr    cc_UC, B_NLS_set
ROM:008A3B30 ; ---------------------------------------------------------------------------
ROM:008A3B30
ROM:008A3B30 B_LC_reset:                             ; CODE XREF: ROM:008A3AF4j
ROM:008A3B30                                         ; ROM:008A3AF8j ...
ROM:008A3B30                 extp    #0E0h, #1 ; 'a'
ROM:008A3B34                 movb    rl4, B_alsflags
ROM:008A3B38                 bclr    r4.0
ROM:008A3B3A                 extp    #0E0h, #1 ; 'a'
ROM:008A3B3E                 movb    B_alsflags, rl4
ROM:008A3B42                 jmpr    cc_UC, B_NLS_set
ROM:008A3B44 ; ---------------------------------------------------------------------------
ROM:008A3B44
ROM:008A3B44 B_als_reset:                            ; CODE XREF: ROM:008A3AE2j
ROM:008A3B44                                         ; ROM:008A3AEEj
ROM:008A3B44                 extp    #0E0h, #1 ; 'a'
ROM:008A3B48                 mov     B_alsflags, ZEROS
ROM:008A3B4C                 jmpr    cc_UC, flg_return
ROM:008A3B4E ; ---------------------------------------------------------------------------
ROM:008A3B4E
ROM:008A3B4E B_NLS_set:                              ; CODE XREF: ROM:008A3B2Ej
ROM:008A3B4E                                         ; ROM:008A3B42j
ROM:008A3B4E                 extp    #0E0h, #1 ; 'a'
ROM:008A3B52                 movb    rl4, B_alsflags
ROM:008A3B56                 jb      r4.0, nls_bit_reset
ROM:008A3B5A                 movb    rl4, CWALS
ROM:008A3B5E                 jnb     r4.1, nls_bit_reset
ROM:008A3B62                 jnb     Cl_Br_Pos_Cond.13, nls_bit_reset
ROM:008A3B66                 jb      Cl_Br_Pos_Cond.9, nls_bit_reset
ROM:008A3B6A                 mov     r4, nmot_w
ROM:008A3B6E                 exts    #81h, #1 ; 'ü'
ROM:008A3B72                 mov     r9, NLSRPMThresh
ROM:008A3B76                 cmp     r4, r9
ROM:008A3B78                 jmpr    cc_ULE, nls_bit_reset
ROM:008A3B7A                 movbz   r4, wped
ROM:008A3B7E                 exts    #81h, #1 ; 'ü'
ROM:008A3B82                 movbz   r9, NLSAccPedal
ROM:008A3B86                 cmp     r4, r9
ROM:008A3B88                 jmpr    cc_ULE, nls_bit_reset
ROM:008A3B8A                 extp    #0E0h, #1 ; 'a'
ROM:008A3B8E                 movb    rl4, B_alsflags
ROM:008A3B92                 bset    r4.1
ROM:008A3B94                 extp    #0E0h, #1 ; 'a'
ROM:008A3B98                 movb    B_alsflags, rl4
ROM:008A3B9C                 jmpr    cc_UC, flg_return
ROM:008A3B9E ; ---------------------------------------------------------------------------
ROM:008A3B9E
ROM:008A3B9E nls_bit_reset:                          ; CODE XREF: ROM:008A3B56j
ROM:008A3B9E                                         ; ROM:008A3B5Ej ...
ROM:008A3B9E                 extp    #0E0h, #1 ; 'a'
ROM:008A3BA2                 movb    rl4, B_alsflags
ROM:008A3BA6                 bclr    r4.1
ROM:008A3BA8                 extp    #0E0h, #1 ; 'a'
ROM:008A3BAC                 movb    B_alsflags, rl4
ROM:008A3BB0                 jmpr    cc_UC, flg_return
ROM:008A3BB2 ; ---------------------------------------------------------------------------
ROM:008A3BB2
ROM:008A3BB2 flg_return:                             ; CODE XREF: ROM:008A3B4Cj
ROM:008A3BB2                                         ; ROM:008A3B9Cj ...
ROM:008A3BB2                 rets
ROM:008A3BB2 ; ---------------------------------------------------------------------------


And then the RAM functions
als_kr_disable:                         ; CODE XREF: sub_872D1C+90P
ROM:008A4000                 extp    #0E0h, #1 ; 'a'
ROM:008A4004                 movb    rl4, B_alsflags
ROM:008A4008                 cmpb    rl4, #0
ROM:008A400C                 jmpr    cc_NZ, loc_8A4014
ROM:008A400E                 bset    b_kr.14
ROM:008A4010                 jmps    87h, loc_872DB2
ROM:008A4014 ; ---------------------------------------------------------------------------
ROM:008A4014
ROM:008A4014 loc_8A4014:                             ; CODE XREF: ROM:008A400Cj
ROM:008A4014                 jmps    87h, loc_872DB0
ROM:008A4018
ROM:008A4018 ; =============== S U B R O U T I N E =======================================
ROM:008A4018
ROM:008A4018
ROM:008A4018 ALS_lamfaset:                           ; CODE XREF: sub_8693B6:lamfa_hijackP
ROM:008A4018                 extp    #0E0h, #1 ; 'a'
ROM:008A401C                 movb    rl6, B_alsflags
ROM:008A4020                 cmpb    rl6, #0
ROM:008A4024                 jmpr    cc_NZ, als_lamfa
ROM:008A4026                 extp    #0E1h, #1 ; 'ß'
ROM:008A402A
ROM:008A402A stk_lamfa:
ROM:008A402A                 mov     lamfaw_w, r4
ROM:008A402E                 jmpr    cc_UC, lam_ret
ROM:008A4030 ; ---------------------------------------------------------------------------
ROM:008A4030
ROM:008A4030 als_lamfa:                              ; CODE XREF: ALS_lamfaset+Cj
ROM:008A4030                 mov     r4, #6Ch ; 'l'
ROM:008A4034                 extp    #0E1h, #1 ; 'ß'
ROM:008A4038                 mov     lamfaw_w, r4
ROM:008A403C                 jmpr    cc_UC, lam_ret
ROM:008A403E ; ---------------------------------------------------------------------------
ROM:008A403E
ROM:008A403E lam_ret:                                ; CODE XREF: ALS_lamfaset+16j
ROM:008A403E                                         ; ALS_lamfaset+24j
ROM:008A403E                 rets
ROM:008A403E ; End of function ALS_lamfaset
ROM:008A403E
ROM:008A4040
ROM:008A4040 ; =============== S U B R O U T I N E =======================================
ROM:008A4040
ROM:008A4040
ROM:008A4040 als_zwoutset:                           ; CODE XREF: sub_89CD08:zwout_als1P
ROM:008A4040                                         ; sub_89CD08:loc_89CDA6P ...
ROM:008A4040                 extp    #0E0h, #1 ; 'a'
ROM:008A4044                 movb    rl6, B_alsflags
ROM:008A4048                 cmpb    rl6, #0
ROM:008A404C                 jmpr    cc_NZ, als_zwout
ROM:008A404E
ROM:008A404E stk_zwout:
ROM:008A404E                 movb    zwout, [r12]
ROM:008A4052                 jmpr    cc_UC, zwout_ret
ROM:008A4054 ; ---------------------------------------------------------------------------
ROM:008A4054
ROM:008A4054 als_zwout:                              ; CODE XREF: als_zwoutset+Cj
ROM:008A4054                 movb    rl4, #0E4h ; 'S'
ROM:008A4058                 movb    rl4, zwout
ROM:008A405C                 jmpr    cc_UC, zwout_ret
ROM:008A405E ; ---------------------------------------------------------------------------
ROM:008A405E
ROM:008A405E zwout_ret:                              ; CODE XREF: als_zwoutset+12j
ROM:008A405E                                         ; als_zwoutset+1Cj
ROM:008A405E                 rets
ROM:008A405E ; End of function als_zwoutset
ROM:008A405E
ROM:008A405E ; ---------------------------------------------------------------------------

Tested it.  Quick stutter at rpm threshold and then EPC light and nothing in the system.  I'm guessing I need to shutdown misfire recognition when the system is active.

So going through the FR I think I have some of my problem figured out.  Im going back to my older maps because they created less problems when the system didnt work.  My spark is following zwist and hanging around 0 instead of dropping to -20.  Going to write zwgru, zwmnms, zwmn, and dzws or zwist.  zwist is zwopt minus dzws.  i believe if that zwist is the way to go
   

How does B_mdstop get written?  I can see where its check for being 8 or not, but not how it becomes 8.

It's enough to write zwgru, I've been doing it for years.

Your code is horrible (sorry). You seem to know some basics about programming but you lack knowledge about how the ECU works...
You need both to make anything useful.

I didn't know anything about coding before I started trying this.  Ive been trying to follow the FR to track how things move through the system.  Basically, I know what I want, and I know people have done it, but no one has published anything about it.  So trying to do it myself.  Can you tell me whats horrible?

With afr, I know that you have lamfaw, lambts, and Lamfakr and that the richest will be used.

For ignition I think zwnws is the value gotten from KFZW/KFZW2.  It then gets dzwkg, dzwol, and dzwoag added to it to become zwgru.  Then dzwwl, dzwob, wkrdy, dwkr, dzwzk, and dzwbank are all added to zwgru.  Its switched based on whether its at start and then vszw, zwappl, and vstdzw are added and it becomes zwbas.  zwbas goes through a minimum check that comes out of KLZWBSMN.  It gets switched with zwsol, which is zwopt plus or minus dzws.  It must be greater than zwspae and less than zwbas.  Its then switched with zwspae, which comes from zwmnms and zwmnd from zwmn.  wphg and zwdllprt are added and then its checked against the min and max constants, signed 4E and E0, and comes out as zwout.

I am trying.  I changed from map switching to replacing ram values.  Can I get a pointer where Im wrong now.  Alter B_nozwe to cut off the reference to zwist and get my value of zwgru to go through? 

No? http://nefariousmotorsports.com/forum/index.php?topic=10485.msg114637#msg114637

Thank You.

I told you what to do - set zwgru to preset value or use a RPM based 1D map, as that is going to decide how much boost you build.
I don't know why you want to switch lambda, in most cases this is completely unnecessary.

There's only 2 things to do - switch zwgru and disable KR. Both are doable in around 5-6 instructions...

Also misfire detection?

I have never ever had issues with misfire detection on ME7 with my NLS and LC algorithm.
But maybe that's because I don't use copy-paste code? :p

Thanks. The question wasn't out of personal experience, just curiosity about which circumstances might cause misfire detection to be triggered and if they exist, what approach one should take to avoid it, or if detection has to be deliberately disabled during LC/NLS activation

C'mon, copy and paste is a good method, if you know what you are doing ;) Otherwise we would be nowhere anywhere where we are with software today. And don't tell me you've never done it ;)

Don't recall where it was, but that's the same thing gt-innovation said when I asked about this - ME7-s are not a problem, but some MED-s may or may not complain. I guess it all depends on the misfire detection algorithms which with sensitivity growing with sophistication will cause trouble.

C'mon.  I feel like im doing halfway decent for someone whos never written a line of code or done disassembly ever before working without an assembler.  I at least am starting to be able to read code that i haven't been told what it is, and find variables and maps that are missing out of my definitions.  Like the system constant min and max values for timing. 

Yes its not bad what you have gathered, and also nice you try to do it out in the open. Ok, compliment mode off.
You can not log or view custom ignition angles in ZWIST (or any other variable for that matter) if you place them in ZWOUT. That is because they never passed through there. You change it right at the end of the chain. But if you log ZWOUT and see the number, you can be sure actual follows this.
That is what we have been telling you, but you seem to like the sightseeing tourist tour approach  :D
let me help you:
Ok, all fine up to here. But then you totally screw things up!

Read it, think about it and understand where the error is.

Advanced version of this:
To make the function more flexible, you can change the hardcoded number and place either a flash location (extp #8Ah, movb rl4, byte_8A1234 for example and place your editable angle there). Benefit of this is you place the value somewhere safe, where people dont accidentally write the wrong parts of the code.
You can also make a seperate lookup function for 2D or 3D and have the result end in custom ram adress 0x381234. Then you can use this ram adress in your code (extp 0E0h, movb rl4, byte_381234). Benefit of this approach is you have a variable that will be calculated from a map, conditions etc.

I caught that after my first test and felt stupid..  I had made the instruction F3 instead of F7.  I rewrote it, went out and tested it, still got a epc light.

On my original, everything worked when I tested it.  zwgru dropped, zmnms also dropped.  Zwopt was high and zwist and zwout followed each other.  Im thinking if I drop zwist, zwout would follow.  A lot like how the overrun fueling stuff needs a change to zwopt to retard the timing. That said a simplification over the original seems like a good idea.

I also understand the ram location write, I just did the constant because all the maps i did were the same throughout, so a constant was fine.  And the constant can be addressed through an xdf.

Try to do 1 thing at a time.
Remove all other extra's, add just your revised zwout custom code part to ALL zwouts. Done.
It works? ok, then try to do the next part. This way you will know what part of the code messes things up.

-20 degrees is ridiculous too, there will be no combustion with that amount of timing retard at all.
So what you'll end up with is timing oscillating rapidly between -20 and whatever comes in from the maps if you do it smart (RPM hysteresis lockout), and if you do it stupid, then the engine will just die the moment you enter LC mode.

Play with a standalone ECU with ALS/LC on an actual car to understand how it is implemented and what sane values are.
At least write the specification of the algorithm down of what you're trying to do before starting to mess with code.

I was speaking with a subaru tuner at a race a couple weeks ago.  Last week he sent me the common subaru and Mitsubishi antilag files.  Think those would be of any use?

Ok, so after everyones suggestions, this seems to be what Im after.  Change zwgru to -10 (will need revisions and maybe a map) and disable kr.  Nothing else. 

ROM:008A4000 als_kr_disable:                         ; CODE XREF: sub_872D1C+90P
ROM:008A4000                 extp    #0E0h, #1 ; 'a'
ROM:008A4004                 movb    rl4, B_alsflags
ROM:008A4008                 cmpb    rl4, #0
ROM:008A400C                 jmpr    cc_NZ, kr_disabled
ROM:008A400E                 bset    b_kr.14
ROM:008A4010                 jmps    87h, loc_872DB2
ROM:008A4014 ; ---------------------------------------------------------------------------
ROM:008A4014
ROM:008A4014 kr_disabled:                            ; CODE XREF: ROM:008A400Cj
ROM:008A4014                 jmps    87h, loc_872DB0
ROM:008A4018 ; ---------------------------------------------------------------------------
ROM:008A4018
ROM:008A4018 als_zwgruset:                           ; CODE XREF: sub_89DA90+E6P
ROM:008A4018                                         ; sub_89DA90+F6P ...
ROM:008A4018                 extp    #0E0h, #1 ; 'a'
ROM:008A401C                 movb    rl6, B_alsflags
ROM:008A4020                 cmpb    rl6, #0
ROM:008A4024                 jmpr    cc_NZ, als_zwgru
ROM:008A4026
ROM:008A4026 stk_zwgru:
ROM:008A4026                 movb    zwgru, rl4
ROM:008A402A                 jmpr    cc_UC, zwgru_ret
ROM:008A402C ; ---------------------------------------------------------------------------
ROM:008A402C                 movb    rl4, #0F2h ; '='
ROM:008A4030
ROM:008A4030 als_zwgru:                              ; CODE XREF: ROM:008A4024j
ROM:008A4030                 movb    zwgru, rl4
ROM:008A4034                 jmpr    cc_UC, zwgru_ret
ROM:008A4036 ; ---------------------------------------------------------------------------
ROM:008A4036
ROM:008A4036 zwgru_ret:                              ; CODE XREF: ROM:008A402Aj
ROM:008A4036                                         ; ROM:008A4034j
ROM:008A4036                 rets

This good?

No, movb rl4, #0F2h is unreachable in your code ;)

I need to quit working on this code when I'm tired... Stupid mistake. 

and IDK why you want so late ignition, there will be no combustion with that ignition, the engine will just die.
You need like 10-15 deg spark retard from the normal ignition angle to already have a reasonable amount of boost.

Also not too much point posting this code, get a car and test it, and post when it works or doesn't work.

I am after late ignition timing for a rally style bang bang antilag instead of a spark cut antilag.  Everyone keeps saying that using an ignition angle of -10* is too much but the typical rally style antilag runs timing in the -35* to -45* range.  They also employ a throttle kick to maintain airflow and enrich the mixture to cut down on egts.  (This would be in a system active, vehicle in motion, no input on throttle situation)  As far as timing that negative shutting the engine down, it doesnt make sense.  If you fire the spark when the piston has begun its down stroke it minimizes torque input but keeps the primary combustion event in the cylinder, valve, manifold area.  The spark cut versions dont fire any spark and they dont stall the engine.  They push the fuel to wherever it can find an ignition source, be it manifold, turbo, or exhaust from an alternate cylinder.  The goal is to have bang bang antilag as an option when I put the turbo restrictor in. 

How about you get some experience before stating these things. Everything you're saying is ridiculous.

40 degrees ATDC, absolutely shuts the engine down instantly. There is no power produced. I don't know where you got the idea about "rally style antilag" you sure as hell don't seem like anyone who has EVER tuned an antilag system before. My company does rally cars on standalone and I can guarantee not a single one of them has 40 deg atdc timing.
Not a single modern car has any "throttle kick", e-throttle is used for antilag and air control.

Same goes for 20 degrees ATDC.

Instead of discussing this stuff here and having opinions about shit you've never even done, how about go out and get some experience?

Look at the KFZWMN table for your car, try to find out what it represents in terms of engine capability to accept retarded spark.

On the anti-lag I developed for the Fiat engine, 10-12 retard worked somewhat, but it was shooting like a bomb and in the opinion of everybody but the owner was too excessive (and I am 99% certain that it was not even the requested value, but effectively a limit from KFZWMN). So I was told, I have not experienced it live, though have seen a video. Also, the car has a considerably bigger turbo compared to factory.

I get the e throttle thing.  But all that would be required is to crack the throttle via the ecu.

Tell me where my concept is wrong.  When engine speed exceeds limits, the spark is retarded, eventually with some hysteresis, to the point where no power is produced but the charge is still used to spin the turbo.  The throttle is adjusted to an extent to allow air in.  When engine speed drops below threshold, ignition timing is restored and normal throttle function resumes.  How much boost pressure is built by the system can be controlled by wastegate duty cycle and how much the throttle opens and can be adjusted to match surface conditions. 

A retarded spark angle will not instantly stop an engine, it will just not add power.  Properly timed there would be no difference between a retarded spark and cutting dwell time on the coil to not get any spark with the exception of providing an ignition source.  I know you can slow an engine without the throttle 3 ways, spark retard, spark cut, and fuel cut.  Spark retard is going to be roughest on egts.

Im going to continue to tinker with this and figure it out.  If I blow up my engine, ill pop another one in. 

In looking at KFZWMN in the FR it makes the point that this would be the latest angle at which the combustion event would not be audibly heard.  This tells me I likely have to move beyond KFZWMN.  Also worth noting is that this is a feature that the subie guys are able to implement with the carberry Rom thats floating around.

It went wrong at the point where you said that boost is controlled by WGDC. No it's not. Boost is controlled by the amount of timing retard,WGDC is flat 100%. And the difference between retarding timing until no more power is made vs retarding timing enough that there is sufficient boost and then cutting spark as soon as you exceed the RPM threshold is the difference between molten pistons and the engine that is running.

So yeah, your "concept" is very wrong at the core.
Which is fine because you have zero experience, what is not fine is claiming you know how everything works when you don't.

hey prj if you wanna hate, you should go to audizine and troll there. Know what is helpful and what is toxic. Some of us aren’t professionals. You could help or do nothing instead of being an ass.