Pages: [1] 2 3 ... 10
 1 
 on: Today at 02:55:58 AM 
Started by WillItBoost - Last post by prj
Yes it is out of the case, and what do you mean trace things that aren't there? The port expander? d3irb suggested I look into how it works sending me down that dead end. There is no port expander in this ECU. I assumed from what was said, and info in the link provided that ME7's are all 'dual-core' so I assumed there may be two MCU's in one package.
There's no two core C167 - does not exist, wrong assumption.
Quote
Do you have any information on the CC650? pinout, register mappings, datasheets?
No.

 2 
 on: Today at 01:57:05 AM 
Started by vitali1411 - Last post by vitali1411
Thanks for your answer @ratosluaf,

- "Make your kfldimx linear with maximum cell higher than boost target"

I did, or is my KFLDIMX wrong too?

In general I misundestood the 10 to 95% --> I thought limit boost via KFLDHBN and adjust KFLDRL according to the logs.
That way seems to work too, but of course I will try the way you mentioned.

 3 
 on: Today at 12:28:50 AM 
Started by vitali1411 - Last post by ratosluaf
Quite not.
- Set entire KFLDHBN to 1.8594
KFLDHBN is max pressure to ambient ratio, so with this you're setting your boost limit to 0,85 bar in "normal" (1 + 0,85) circumstances. You can limit your boost with this map or with ldrxn.

For logging purposes, you need to set your boost request higher than your boost target in order to not get any interventions.

Make your kfldimx linear with maximum cell higher than boost target, then do cwmdapp = 8, and make runs with kfldrapp forcing wgdc from 10 to 95% or max  you can safely run. Then use ldrpidtool and just paste your kfldrl output, thats all

Just do not get any boost interventions during logging, this tool makes it pretty damn easy and accurate.

 4 
 on: Yesterday at 08:12:05 PM 
Started by WillItBoost - Last post by WillItBoost
Yes it is out of the case, and what do you mean trace things that aren't there? The port expander? d3irb suggested I look into how it works sending me down that dead end. There is no port expander in this ECU. I assumed from what was said, and info in the link provided that ME7's are all 'dual-core' so I assumed there may be two MCU's in one package.

From what I can see, it's a C167 MCU with 32k mask rom, external 512k flash + 32k sram, the CC650, a LDO power management IC, Injector driver, Discrete coil driver (with phase sensing), H-bridge driver, and a smaller unknown 16pin IC (sc551710mdw) which has its own 4mhz xtal and connects to the CC650. There's a few LM op-amps on the underside for analog stuff, and what I guess is a pair of VR IC's for crank/speed inputs. A very nice, well designed development board for engine management.

The C167's ADC channels are all routed too so I'm not sure how much of the CC650 is being used for ADC.

Do you have any information on the CC650? pinout, register mappings, datasheets?

Right now I'm working on my monitor program to help map out all the I/O to the respective external inputs and outputs, the fault detection signals from the driver IC's and enable signals and anything else that is required to control an engine with my own code. At a bare minimum, if I can read battery voltage, map, tps, iat, clt, detect the teeth from the VR circuit, and control injectors, IAC and coils, I can write some speed density code as a proof of concept

 5 
 on: Yesterday at 07:28:57 PM 
Started by WillItBoost - Last post by prj
Have you not removed the board from the case?
Why trace things that aren't there?

30380 is CC650. It's a knock IC + 16 channel ADC.
There's no other larger chips on the board = no port expander.

 6 
 on: Yesterday at 06:56:21 PM 
Started by dizzy62134 - Last post by _nameless
Hello  Smiley

I'm new to the forum and looking for someone with a lot of knowledge with ME 7.1.1 and the 2.7t platform, as you may know its not easy to find someone willing to tune ME 7.1.1 and i have been struggling myself, the one guy i got in contact with is unreliable and super hard to reach. Anyway I am looking for someone to remote tune or if you live near me in person, the car has a file on it already that is IMMO delete and should just need to be revised as it was used for a previous setup but I am running something more aggressive (bigger turbos, bigger injectors etc...). I'm looking to squeeze all the juice out of my setup with the extra goodies a swell, (launch control, rolling anti lag, NLS ETC...) if you could help me get this done and are confident in your work please PM me and we can chat more about this matter. I can do PayPal/ETF and we can discuss a fair price for the work.

Thanks everyone.
Calibration is no more involved than any other version of me7, so that's not a problem for someone who has a clue. My question to you is are you able to take proper data logs?

 7 
 on: Yesterday at 06:34:12 PM 
Started by WillItBoost - Last post by WillItBoost
I traced back the 4 injector outputs through the injector driver, then back into the C167 (PWM channels 0-3, P7.0 - P7.3). A few lines of code to set these pins as outputs and toggle them and we're seeing nice clean outputs on PWM0 and PWM1 channels.

There are test pads on the PCB for these channels, and other important signals. I'll find where they go and write some code to test them all. I don't think there's a secondary C167 or port expander in this ECU. At least not for the Injector driver anyway. I'll test spark outputs next, and VR/Analog inputs and if they're all accessible then I can get back on track and get some speed density code running.

The 30380 looks to have a parallel bus (8bit), /RD, /WR and a /CS line so that should be easy to spot in IDA. It looks to use /CS4 to select but not the standard external memory data lines that the SRAM and Flash share, so it probably isn't memory mapped.


 8 
 on: Yesterday at 05:54:18 PM 
Started by dizzy62134 - Last post by dizzy62134
Hello  Smiley

I'm new to the forum and looking for someone with a lot of knowledge with ME 7.1.1 and the 2.7t platform, as you may know its not easy to find someone willing to tune ME 7.1.1 and i have been struggling myself, the one guy i got in contact with is unreliable and super hard to reach. Anyway I am looking for someone to remote tune or if you live near me in person, the car has a file on it already that is IMMO delete and should just need to be revised as it was used for a previous setup but I am running something more aggressive (bigger turbos, bigger injectors etc...). I'm looking to squeeze all the juice out of my setup with the extra goodies a swell, (launch control, rolling anti lag, NLS ETC...) if you could help me get this done and are confident in your work please PM me and we can chat more about this matter. I can do PayPal/ETF and we can discuss a fair price for the work.

Thanks everyone.

 9 
 on: Yesterday at 05:51:17 PM 
Started by WillItBoost - Last post by WillItBoost
I followed the traces from the eeprom to MCU:

eeprom CS - P4.7
eeprom clk - P3.13
eeprom Din - P3.9
eeprom Dout - P3.8

So that function appears to be EEPROM access, not necessarily the Port expander...

I might need to work backwards from the A2L file, find the ram location for coolant temp for example, work back to the function that populates that ram location and find where it sources its data from.


 10 
 on: Yesterday at 05:15:18 PM 
Started by WillItBoost - Last post by WillItBoost
I have looked at the board, and there is a smaller second ASIC labeled '30380'. This is said to contain the Knock IC and additional ADC channels. This is somewhat confirmed by Bosch's application pdf that says pretty much that. I suppose a quick IO test on one of the ports will confirm if there is a second MCU or not in the same die.

I've been looking through the firmware and I have found this small function:

seg009:00001B26 sub_81B26:
seg009:00001B26                 bset    P4_7
seg009:00001B28                 bset    DP4_7
seg009:00001B2A                 nop
seg009:00001B2C                 bset    P3_8
seg009:00001B2E                 bclr    DP3_8
seg009:00001B30                 extr    #1
seg009:00001B32                 bset    ODP3_8
seg009:00001B34                 bset    P3_9
seg009:00001B36                 bset    DP3_9
seg009:00001B38                 extr    #1
seg009:00001B3A                 bclr    ODP3_9
seg009:00001B3C                 bset    P3_13
seg009:00001B3E                 bset    DP3_13
seg009:00001B40                 extr    #1
seg009:00001B42                 bclr    ODP3_13
seg009:00001B44                 rets
seg009:00001B44 ; End of function sub_81B26
seg009:00001B44

Which is setting up port direction and state, and right after this function we are setting up SSCCON, and the following function:

seg009:00001C6C SSC_func4_PEC_dualcore?_:               ; CODE XREF: sub_81C64↑j
seg009:00001C6C                 mov     r4, #200h
seg009:00001C70                 or      r4, r12
seg009:00001C72                 mov     PECC4, r4
seg009:00001C76                 mov     r4, r13
seg009:00001C78                 mov     r5, r4
seg009:00001C7A                 shr     r5, #14
seg009:00001C7C                 shl     r5, #1
seg009:00001C7E                 mov     r5, [r5+0FE00h]
seg009:00001C82                 bmov    r4.14, r5.0
seg009:00001C86                 bmov    r4.15, r5.1
seg009:00001C8A                 shr     r5, #2
seg009:00001C8C                 mov     r14, r4
seg009:00001C8E                 mov     word_FCF2, r14
seg009:00001C92                 mov     r4, #0F0B2h
seg009:00001C96                 mov     word_FCF0, r4
seg009:00001C9A                 mov     r4, #400h
seg009:00001C9E                 or      r4, r12
seg009:00001CA0                 mov     PECC0, r4
seg009:00001CA4                 mov     r4, #0F0B0h
seg009:00001CA8                 mov     word_FCE2, r4
seg009:00001CAC                 mov     word_FCE0, r14
seg009:00001CB0                 and     SSCCON, #0F0FFh
seg009:00001CB4                 bclr    SSCEIR
seg009:00001CB6                 mov     SSCRIC, #7Ch ; '|'
seg009:00001CBA                 mov     SSCTIC, #0F8h
seg009:00001CBE                 mov     r4, #1
seg009:00001CC0                 rets
seg009:00001CC0 ; End of function sub_81C64

Which suggests the communication channel is similar as the dual core link you referenced earlier, PECC0 and PECC4 being used for SSC transfer direct to XRAM. I'll double check which port the EEPROM /CS is tied to be sure this isn't just an eeprom data handler function and is related to the Port Expander. I think we're getting somewhere.





Pages: [1] 2 3 ... 10
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.015 seconds with 15 queries. (Pretty URLs adds 0.001s, 0q)