larppaxyz
Jr. Member
Karma: +4/-0
 Offline
Posts: 45
|
 |
« on: November 02, 2019, 03:12:23 AM »
|
|
|
Backstory : Fitted turbo to my VR6 3.2 Cayenne.
After testing out some things and help from here i now have good XDF to work with. Injectors are adjusted for 50% ethanol, general torque limit maps are adjusted, downscaled MAF using KFKHFM and all that.
So my actual straight to point question is : Can 100.0% limit on MDFUE function be modified/found on ECU file, or is it buried in code?
For me, it looks like if we could change that value to lets say 150%, we could use more sensible values on KFMIOP axis and we could do without MAF scaling?
Picture for reference. It shows tat 100.0 cap directly limits value coming out from KFMIRL. As a sidenote, it would be cool to modify CWRLAPPL in such way that throttle would control requested torque directly....
|
|
|
|
« Last Edit: November 02, 2019, 03:22:32 AM by larppaxyz »
|
Logged
|
|
|
|
|
_nameless
|
|
« Reply #1 on: November 02, 2019, 03:51:29 AM »
|
|
|
I can find the load cap ive found it in other versions
|
|
|
|
|
Logged
|
Giving your mom a tuneup
|
|
|
larppaxyz
Jr. Member
Karma: +4/-0
Offline
Posts: 45
|
|
« Reply #2 on: November 02, 2019, 05:06:10 AM »
|
|
|
I can find the load cap ive found it in other versions
Thanks man, you already did few weeks ago and i really appreciate it. You helped me locate important maps too  You gave me two addresses, both had stock values of 100. I didn't know that those values actually are related to values i'm talking in this thread but i'm happy to know that they are. How do you locate them? Do you search for actual function binary and go from there or use IDA or something? |
|
|
|
|
Logged
|
|
|
|
fluke9
Full Member
Karma: +26/-1
Offline
Posts: 113
|
|
« Reply #3 on: November 02, 2019, 11:46:53 AM »
|
|
|
Picture for reference. It shows tat 100.0 cap directly limits value coming out from KFMIRL. As a sidenote, it would be cool to modify CWRLAPPL in such way that throttle would control requested torque directly....
According to your picture you just need to set the correct bits for this to happen, you will not follow the MN/MX path then. BIT1 to 0 BIT2 to 1 But the FR also says: CWRLAPPLFW codeword rlsolw from Test-bench for Applikation  |
|
|
|
« Last Edit: November 02, 2019, 11:51:35 AM by fluke9 »
|
Logged
|
|
|
|
fluke9
Full Member
Karma: +26/-1
Offline
Posts: 113
|
|
« Reply #4 on: November 02, 2019, 12:15:01 PM »
|
|
|
As i am just disassembling my ME7.4.1 and the version of this function is the same: The lookup for the Table happens here: 85A16C loc_85A16C: ; CODE XREF: FKT_MDFUE__Sollwervorgabe_fuer_Luftmasse_aus_Sollmoment+42↑j
85A16C mov r2, #0FFFFh
85A170
85A170 loc_85A170: ; CODE XREF: FKT_MDFUE__Sollwervorgabe_fuer_Luftmasse_aus_Sollmoment+48↑j
85A170 mov misopl1_w, r2 ; Solluftmoment, r_ckgerechnet auf Lambda=1 und zwopt
85A174
85A174 loc_85A174: ; CODE XREF: FKT_MDFUE__Sollwervorgabe_fuer_Luftmasse_aus_Sollmoment+1E↑j
85A174 mov r12, #KFMIRL ; Kennfeld f_r Berechnung Sollf_llung
85A178 mov r13, nmot_w ; Motordrehzahl
85A17C mov r14, misopl1_w ; Solluftmoment, r_ckgerechnet auf Lambda=1 und zwopt
85A180 calls 0, WLookup2D_BoostAndFuel_73de ; 2D Lookup Word Arguments usually Boost and Fuel related
85A180 ;
85A180 ; r12= Map address, 1st byte width, 2nd byte height
85A180 ; r13= Y
85A180 ; r14= X
85A184 mov r8, r4
85A186 jnb word_FD7C.B_sa, loc_85A192
r8 is the result of the KFMIRL lookup and gets used a lot further down in the function here the first time: 85A230 loc_85A230: ; CODE XREF: FKT_MDFUE__Sollwervorgabe_fuer_Luftmasse_aus_Sollmoment+C8↑j
85A230 cmp r8, #10AAh
85A234 jmpr cc_C, loc_85A240
85A236 mov r4, #10AAh
85A23A mov rlsol_w, r4 ; Soll-F_llung
85A23E jmpr cc_UC, loc_85A254
0x10AAh = 4266 decimal rlsol_w range is 0 to 1535.9765625 So 1535.9765625 / 65535 * 4266 equals *guess what * 99.984375 Here is your limit .... If you are lucky and your compile matches mine you should find the hex string: 46 F8 AA 10 8D 05 E6 F4 AA 10 F6 F4 10 A1 replace the red two bytes with your new load limit in cpu byte order, you might or might not bother to replace the second one too so if you really hit it it gets replaced with your limit not the 99.98 |
|
|
|
« Last Edit: November 02, 2019, 12:24:28 PM by fluke9 »
|
Logged
|
|
|
|
|
Blazius
|
|
« Reply #5 on: November 02, 2019, 12:28:31 PM »
|
|
|
CWMDAPP with proper bits does the same , though the CWLAPP wont disable the DK control only controlling torque differently. However you can patch the load caps , where it overwrites the output the KFMIRL , but also there are like 4 or more of them and if you do not get them all the Throttle control goes mad and wont let you start the car , as I said in a different post. Also setting cwrlapp bit 2 to true will completely skip KFMIRL but you realise that your requested load will only depend on the pedal pos * a factor, so you gonna get intervention, limp and or terrible driveability. Also as you can see , RLMAX is NOT the input to KFMIOP so basically half of the torque control talk is useless, instead you will have to change RLVMXN and the factor maps most likely, for that you need to set the ecu in direct pedal mode to get WOT for ME 7.5 MDMAX 1.40, the values are done with 30C +/- 10% tans over the speed points. Now RLVMXN is not defined in most damos, so good luck finding. Welcome to my world. EDIT: there you go, fluke just basically posted the whole thing, good job, however the above still applies you need to find all the caps. |
|
|
|
« Last Edit: November 02, 2019, 12:31:02 PM by Blazius »
|
Logged
|
|
|
|
larppaxyz
Jr. Member
Karma: +4/-0
Offline
Posts: 45
|
|
« Reply #6 on: November 02, 2019, 12:28:56 PM »
|
|
|
As i am just disassembling my ME7.4.1 and the version of this function is the same: [snip] 0x10AAh = 4266 decimal rlsol_w range is 0 to 1535.9765625 So 1535.9765625 / 65535 * 4266 equals *guess what * 99.984375 Here is your limit .... Excellent! Now i understand why Marty gave me two addresses (7e218 and 7e21e in my case). Other must be for that cmp call and other for mov call. Good stuff. Now i'm sure that value can be easily modified and i understand what it really does. |
|
|
|
|
Logged
|
|
|
|
fluke9
Full Member
Karma: +26/-1
Offline
Posts: 113
|
|
« Reply #7 on: November 02, 2019, 12:41:18 PM »
|
|
|
Excellent! Now i understand why Marty gave me two addresses (7e218 and 7e21e in my case).
Which exactly matches the distance my two values have too, looks sensible. Other must be for that cmp call and other for mov call. Good stuff. Now i'm sure that value can be easily modified and i understand what it really does.
Correct, 46 F8 AA 10 is cmp r8, #10AAh E6 F4 AA 10 is mov r4, #10AAh If you later know such patterns you will find them in a lot of other bins, as a lot of functions are precompiled or from the same source, and if the version of the function is the same it is almost always the same even binary wise. |
|
|
|
« Last Edit: November 02, 2019, 12:43:55 PM by fluke9 »
|
Logged
|
|
|
|
larppaxyz
Jr. Member
Karma: +4/-0
Offline
Posts: 45
|
|
« Reply #8 on: November 02, 2019, 01:04:26 PM »
|
|
|
CWMDAPP with proper bits does the same , though the CWLAPP wont disable the DK control only controlling torque differently. However you can patch the load caps , where it overwrites the output the KFMIRL , but also there are like 4 or more of them and if you do not get them all the Throttle control goes mad and wont let you start the car , as I said in a different post. Also setting cwrlapp bit 2 to true will completely skip KFMIRL but you realise that your requested load will only depend on the pedal pos * a factor, so you gonna get intervention, limp and or terrible driveability. Also as you can see , RLMAX is NOT the input to KFMIOP so basically half of the torque control talk is useless, instead you will have to change RLVMXN and the factor maps most likely, for that you need to set the ecu in direct pedal mode to get WOT for ME 7.5 MDMAX 1.40, the values are done with 30C +/- 10% tans over the speed points. Now RLVMXN is not defined in most damos, so good luck finding. Welcome to my world. EDIT: there you go, fluke just basically posted the whole thing, good job, however the above still applies you need to find all the caps. Thank you for your input. Really, that CWLAPP thing was just something it throwed in, i know it's not the proper way Because help of Marty, i already have located RLVMXN (and RLVSMXN). Only thing i wasn't sure about was that 100.0 and how it works. I already tested this setup on my car and i have no issues starting it or anything. It has plenty of power and is very driveable. That being said, i can't yet confirm that load cap actually did change. I currently have no log data to prove that. |
|
|
|
|
Logged
|
|
|
|
|
_nameless
|
|
« Reply #9 on: November 02, 2019, 01:15:56 PM »
|
|
|
Set it to 200 and extend irl to load ranges you plan on running
|
|
|
|
|
Logged
|
Giving your mom a tuneup
|
|
|
|
Blazius
|
|
« Reply #10 on: November 02, 2019, 01:33:37 PM »
|
|
|
Me7logger doesnt work?
|
|
|
|
|
Logged
|
|
|
|
larppaxyz
Jr. Member
Karma: +4/-0
Offline
Posts: 45
|
|
« Reply #11 on: November 02, 2019, 02:03:00 PM »
|
|
|
Me7logger doesnt work?
For some reason it doesn't connect. Tried different setups (com,ftdi,speeds,different laptop,different cable...) but always no connection at all. Only thing untested at this point is to pull can/k-line/whatever directly from ECU wiring harness and see if that does the trick. Could be some Porsche specific thing. |
|
|
|
|
Logged
|
|
|
|
fluke9
Full Member
Karma: +26/-1
Offline
Posts: 113
|
|
« Reply #12 on: November 02, 2019, 02:40:20 PM »
|
|
|
Me7Logger should be called VAGLogger imho as its implementation does not work with most other manufacturers... ;-)
But it should work with that VW Engined Porsch i guess...
|
|
|
|
|
Logged
|
|
|
|
|
IamwhoIam
|
|
« Reply #13 on: November 05, 2019, 09:52:33 AM »
|
|
|
on this type of ECU (32MHz C167 ME7.1.1), ME7logger should work without any problems.
|
|
|
|
|
Logged
|
I have no logs because I have a boost gauge (makes things easier)
|
|
|
mbkr89
Full Member
Karma: +2/-4
Offline
Posts: 96
|
|
« Reply #14 on: November 12, 2019, 12:14:57 PM »
|
|
|
I can find the load cap ive found it in other versions
is the cap in the flash ? |
|
|
|
|
Logged
|
|
|
|
|
