Pages: 1 ... 16 17 [18] 19 20 21
Author Topic: 06A906032HN, Implementation of launch-control and NLS  (Read 211396 times)
janne
Full Member
***

Karma: +2/-0
Offline Offline

Posts: 50


« Reply #255 on: November 29, 2014, 05:54:35 AM »

Hi.
I use that script what does this function.
But I think it does something wrong?
My inj code is not long enought right?

I have read.read.read , but I really cant understand those adress things.
Can someone push me into right direction.
Thanks
Logged
KmosK04
Full Member
***

Karma: +5/-9
Offline Offline

Posts: 96


« Reply #256 on: November 29, 2014, 07:14:25 AM »

I didn't see your file but those are the steps that I follow:

1. Make an .ecu file from your bin with me7logger
2. Find empty spaces in your bin to put the variables and the code
3. Write down the adresses
4. Put in one folder the script, ecu file and bin.
5. Launch the script from cmd
6. Type launch.exe YOURFILE.bin YOURFILE.ecu 0xCODE ADRESS 0xVARIABLES ADRESS

Logged
pOwy
Full Member
***

Karma: +0/-0
Offline Offline

Posts: 52


« Reply #257 on: October 01, 2016, 04:58:32 AM »

hello!

i'm trying to implement the launch control and nls. I have the pdf from the forum and i think i understand. BUT:) in the first line bit 3 is the bit mask of what? i dont get it, because my b_brems is fd4a.3 and b_kuppl is fd4a.7, fd4a=25 but which bit mask i need in line 1 bit 3? from brems? or kuppl?
i checked many files what posted the others but i cant find it out:D

thanks for help
Logged
KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #258 on: December 09, 2016, 04:16:27 PM »

i've tried to implement this and last time i got a permanent DTC  Undecided

can anybody tell me if there is a mistake, cause i cant seem to see it myself?

ECU is 06A906032HN V002


Code:

Addresses:

tsrldyn: 0x380BB7 0x0000
b_kuppl: 0x00FD4E.14 0x4000
vfil_w: 0x381C0C 0x0000
nmot_w: 0x00F89E 0x0000
wped: 0x3809B1 0x0000
b_brems: 0x00FD4C.12 0x1000
counter: 0x384FF0

SpeedThreshold: 0x17EC0
LaunchRPM: 0x17EC2
IgnitionCutDuration: 0x17EC4
RPMThreshold: 0x17EC6
AccPedalThreshold: 0x17EC8

FTOMN: 0x01A43D

Main Function: 0x0B3000

Call Address: F3 F8 9D 89 -> DA 8B 00 30 [0x0A6062]

9A 27 13 E0 F2 F4 0C 9C D7 00 81 00 F2 F9 C0 7E
40 49 9D 0B F2 F4 9E F8 D7 00 81 00 F2 F9 C2 7E
40 49 FD 03 F7 8E B7 8B 0D 2F 9A 27 29 E0 8A 27
22 C0 F2 F4 9E F8 D7 00 81 00 F2 F9 C6 7E 40 49
FD 1A C2 F4 B1 89 D7 00 81 00 C2 F9 C8 7E 40 49
FD 12 D7 00 38 00 F2 F4 F0 4F D7 00 81 00 F2 F9
C4 7E 40 49 9D 11 F7 8E B7 8B 08 41 D7 00 38 00
F7 F8 F0 4F 0D 09 D7 00 38 00 F6 8F F0 4F 0D 04
D7 00 38 00 F6 8E F0 4F F3 F8 9D 89 DB 00 FF FF

Thanks in advance
Logged
KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #259 on: January 04, 2017, 04:44:59 AM »

I think i found the error, the NLS counter was smack dab in the middle of some used ram adresses, i have now moved it to empty ram space.

im going to try and flash this and see if it works, unless anyone has noticed any other errors?

Code:
Addresses:

tsrldyn: 0x380BB7
b_kuppl: 0x00FD4E.14 0x4000
vfil_w: 0x381C0C
nmot_w: 0x00F89E
wped: 0x3809B1
b_brems: 0x00FD4C.12 0x1000
counter: 0x388100

SpeedThreshold: 0x17EC0
LaunchRPM: 0x17EC2
IgnitionCutDuration: 0x17EC4
RPMThreshold: 0x17EC6
AccPedalThreshold: 0x17EC8

FTOMN: 0x01A43D

Main Function: 0x0B3000

Call Address: F3 F8 9D 89 -> DA 8B 00 30 [0x0A6062]

9A 27 13 E0 F2 F4 0C 9C D7 00 81 00 F2 F9 C0 7E
40 49 9D 0B F2 F4 9E F8 D7 00 81 00 F2 F9 C2 7E
40 49 FD 03 F7 8E B7 8B 0D 2F 9A 27 29 E0 8A 27
22 C0 F2 F4 9E F8 D7 00 81 00 F2 F9 C6 7E 40 49
FD 1A C2 F4 B1 89 D7 00 81 00 C2 F9 C8 7E 40 49
FD 12 D7 00 38 00 F2 F4 00 81 D7 00 81 00 F2 F9
C4 7E 40 49 9D 11 F7 8E B7 8B 08 41 D7 00 38 00
F7 F8 00 81 0D 09 D7 00 38 00 F6 8F 00 81 0D 04
D7 00 38 00 F6 8E 00 81 F3 F8 9D 89 DB 00 FF FF
Logged
KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #260 on: January 06, 2017, 05:15:39 AM »

So this thread is officially dead?
Logged
Khendal
Full Member
***

Karma: +9/-8
Offline Offline

Posts: 226


« Reply #261 on: January 07, 2017, 03:46:51 PM »

So this thread is officially dead?

Mhhh... i hope not.

All of these threads are old... and it's not easy to follow and understand what to do now...which is the right way for nls, lc .. in 2017 Smiley
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #262 on: January 08, 2017, 08:03:36 AM »

Study this disassembled code, I have written exactly how the function works in the comments behind.
Disclaimer: this is the Philadot Mbox code, so all adresses below are ONLY for that ecu and need to be replaced with your own. But it can help you understand what you are writing.
Code:
LC:

seg018:E800                 jnb     word_FD56.8, loc_8E82A    ;if b_kuppl is not set, jump to NLS
seg018:E804                 mov     r4, word_8E40 ;move vfil_w to r4
seg018:E808                 exts    #81h, #1
seg018:E80C                 mov     r9, 7E00h ;move speed_threshold to r9
seg018:E810                 cmp     r4, r9        ;compare r4 to r9
seg018:E812                 jmpr    cc_NC, loc_8E82A ;jump to NLS if vfil_w is larger than speed_threshold
seg018:E814                 mov     r4, word_F87A ;move nmot_w to r4
seg018:E818                 exts    #81h, #1
seg018:E81C                 mov     r9, 7E02h ;move launch rpm to r9
seg018:E820                 cmp     r4, r9        ;compare r4 to r9
seg018:E822                 jmpr    cc_ULE, loc_8E82A ;jump to EXIT if rpm is less or equal to launch_rpm
seg018:E824                 movb    byte_8DAC, ZEROS ;zeros tsrldyn (interrupt spark)
seg018:E828                 jmpr    cc_UC, loc_8E888 ;jump to EXIT unconditionally

NLS:

seg018:E82A loc_8E82A:                            
seg018:E82A                                      
seg018:E82A                 jnb     word_FD56.8, loc_8E880   ;if b_kuppl is not set, jump to UNSET RAMCOUNTER
seg018:E82E                 jb      word_FD56.6, loc_8E876    ;if b_br is set, jump to SET RAMCOUNTER
seg018:E832                 mov     r4, word_F87A ;move nmot_w to r4
seg018:E836                 exts    #81h, #1
seg018:E83A                 mov     r9, 7E06h ;move rmp threshold to r9
seg018:E83E                 cmp     r4, r9        ;compare r4 to r9
seg018:E840                 jmpr    cc_ULE, loc_8E876 ;jump to SET RAMCOUNTER if rpm is less or equal to rpm_threshold
seg018:E842                 movbz   r4, byte_8B02 ;move wped to r4
seg018:E846                 exts    #81h, #1
seg018:E84A                 movbz   r9, 7E08h ;move pedal_threshold to r9
seg018:E84E                 cmp     r4, r9        ;compare r4 to r9
seg018:E850                 jmpr    cc_ULE, loc_8E876 ;jump to SET RAMCOUNTER if wped is less or equal to pedal_threshold
seg018:E852                 exts    #38h, #1
seg018:E856                 mov     r4, 4FF0h ;move ramcounter to r4
seg018:E85A                 exts    #81h, #1
seg018:E85E                 mov     r9, 7E04h ;move cut_duration to r9
seg018:E862                 cmp     r4, r9        ;compare r4 to r9
seg018:E864                 jmpr    cc_NC, loc_8E888 ;jump to EXIT if no carry (ramcounter value is larger than cut_duration)
seg018:E866                 movb    byte_8DAC, ZEROS ;zeros tsrldyn
seg018:E86A                 add     r4, #1        ;add 1 to r4 (increments ramcounter value with 1)
seg018:E86C                 exts    #38h, #1
seg018:E870                 movb    4FF0h, rl4 ;move rl4 to ramcounter
seg018:E874                 jmpr    cc_UC, loc_8E888 ;jump to EXIT unconditionally

SET RAMCOUNTER:

seg018:E876 loc_8E876:                              
seg018:E876                                        
seg018:E876                 exts    #38h, #1
seg018:E87A                 mov     4FF0h, ONES ;Ones in ramcounter 384FF0h (FFFF hex or 65535 dec)
seg018:E87E                 jmpr    cc_UC, loc_8E888

UNSET RAMCOUNTER:
seg018:E880 loc_8E880:                            
seg018:E880                 exts    #38h, #1
seg018:E884                 mov     4FF0h, ZEROS ;Zeros in ramcounter 384FF0h (0000 hex or 0 dec)

EXIT:
seg018:E888 loc_8E888:                              
seg018:E888                                        
seg018:E888                 movb    rl4, byte_8AF3 ;restore original code that was replaced with call
seg018:E88C                 rets        ;jump back to call adress
seg018:E88C ; --------------------------------------------------------------------------


« Last Edit: January 08, 2017, 08:25:21 AM by TijnCU » Logged

KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #263 on: January 21, 2017, 07:55:25 AM »

Got it working now, and it's glorious  Grin
Going to upload a video soon  Smiley
Logged
KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #264 on: January 22, 2017, 11:54:39 AM »

And it just threw a permanent DTC regarding memory checksum error  Angry
Nothing seems out of place in the code and it has worked flawless in multiple drives  Huh

Anybody else experienced the problem?
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #265 on: January 22, 2017, 12:12:13 PM »

RSA checksum error maybe, check eeprom. Try another ram adress, for example 382ff0. (check if this adress holds 0 in me7logger) or disassemble file and verify xrefs to ram.
Logged

KasperH
Hero Member
*****

Karma: +24/-8
Offline Offline

Posts: 632


« Reply #266 on: January 25, 2017, 05:36:24 PM »

RSA checksum error maybe, check eeprom. Try another ram adress, for example 382ff0. (check if this adress holds 0 in me7logger) or disassemble file and verify xrefs to ram.

i'll try and log 384ff0 and 382ff0 tomorrow and see if anything shows up during a drive to work Smiley
Logged
Kacza
Full Member
***

Karma: +20/-6
Offline Offline

Posts: 213


« Reply #267 on: January 26, 2017, 06:33:13 AM »

LC+AL works.
Thanks. Good joob. Cheesy
« Last Edit: January 30, 2017, 02:20:12 PM by Kacza » Logged
armageddon
Sr. Member
****

Karma: +20/-3
Offline Offline

Posts: 348


« Reply #268 on: February 22, 2017, 03:28:44 AM »

Hi all,

As asking doesn't hurt.....


Did anyone add other conditions to the function?

I'm trying to disable knock recognition during nls using b_kr

b_kr is at FD8A.8.

What I did was just add right after trsldyn "movb  byte_FD8A, ZEROS" in hex F7 8E 8A FD just to test if the function will still work.
The function works as before, so maybe I'm not complitly wrong, but I need to get the right convertion for b_kr address to test if this wil work.

Any help/coment would be grateful
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #269 on: February 22, 2017, 04:59:42 AM »

hey, that does not work, you should remove that code from the function because 1) It is not the right way to disable a bit (you are treating it as a byte) and 2) the bit adress is not correctly adressed. You are actually zero-ing something else.
Besides the coding mistake, it is not as simple to disable kr by unsetting b_kr in this routine, you need to make a new function that jumps from a few kr code points and keep me7 from entering kr mode.
Logged

Pages: 1 ... 16 17 [18] 19 20 21
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.026 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)