Pages: [1] 2
Author Topic: Using the runner flap pwm output for water meth med9.1  (Read 8732 times)
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« on: June 27, 2021, 05:28:32 AM »

Hi Guys,

I've been playing with med9 for some time and wanted a new project to keep my brain active and also potentially benefit my car in some way.

My idea was to use the intake runner flap pwm output and wire this to a h bridge controller so i can control a water meth pump using the oem ecu. I was thinking of creating a 3d map based on pvdr/nmot_w with the Z axis being duty cycle of pump. Things like IAT could also be used as compensation and even adding feedback to the rear o2 to let you know the tanks empty and switch back to a safer kfzw etc.

But although the idea seems OK in my head i'm struggling to do 1 very important thing and that's locate the variables for these outputs in the stock ram. I've found the pin numbers from the FR after reading the STECK and STEGO section and i believe the PWM output for the flaps is A35 A_T_LBKPWM1 - Then after disassembling the bin i found the variable for the setpoint for flap position which is 7FC39C in my file. This is where i'm struggling as with it being a pwm output this will be configured somewhere in the bin to set the frequency but I've no experience in using or modifying existing outputs to potentially change its operating frequency to suit needs (probably not needed) or actually locate the exact variable i need to control and output my duty cycle too.

I can create the maps and patch the rest in and i'm wanting to share the project to help others but just need that nudge in the right direction to help get the project moving. I have some knowledge of med9 and powerPC disassembly and have done mapswitching, launch control etc so it should be a feasible task.

FYI im not doing this to be 'cheap' its just purely an interest of mine and i like creating things myself if possible.

Hopefully the right people can help - Cheers

« Last Edit: June 30, 2021, 11:46:58 AM by jacktfsi » Logged
AngelPowy
Full Member
***

Karma: +1/-0
Offline Offline

Posts: 55


« Reply #1 on: June 28, 2021, 01:46:33 AM »

Hey mate, I am really intererested in your project. I do some disassembly myself, and I was thinking of using the LBK output to drive injectors . I guess you can find some solution by looking how LDTV works. If you are interrested we could work together.
Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #2 on: June 28, 2021, 03:22:43 AM »

Hi,

Yes that’s a good idea and I’m sure it’s been done before. Similar to my own project too and I’d definitely be interested in helping! First things first we need to locate the variable and it’s configuration with regards to pwm frequency in the binary. So the whatever gives its final output to A_T_LBKPWM - this could be really simple and it could be the variable I’ve stated but I’m not sure although I will test it and try and see what happens.

If you can find this then I’m sure it will be a big help for both of us.
Logged
AngelPowy
Full Member
***

Karma: +1/-0
Offline Offline

Posts: 55


« Reply #3 on: June 28, 2021, 05:05:57 AM »

Can you please share your file, then I’ll be able to disassemble it at home?
Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #4 on: June 28, 2021, 11:09:32 PM »

Can you please share your file, then I’ll be able to disassemble it at home?

Hi, I'll use this file as i have an A2L for it. My car is 115T but I don't have an a2l and things are much easier with one so if we crack it on 115H I will be able to figure out where everything goes on 115T as they're similar.

If you need the A2L for 115H let me know and ill post it.
« Last Edit: June 30, 2021, 11:41:26 AM by jacktfsi » Logged
AngelPowy
Full Member
***

Karma: +1/-0
Offline Offline

Posts: 55


« Reply #5 on: June 29, 2021, 04:03:02 AM »

I have already worked on this file before. But I don’t have the a2l for it. It would be nice if you can send it to me please.
Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #6 on: June 29, 2021, 12:43:52 PM »

I have already worked on this file before. But I don’t have the a2l for it. It would be nice if you can send it to me please.


Here's the A2L...

Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #7 on: June 30, 2021, 11:42:22 AM »

Here's the A2L...



just noticed i posted the wrong .bin it was sw version 0050 not 0010 so didnt line up correctly with the A2L

here's the correct file.
Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #8 on: June 30, 2021, 01:55:25 PM »

So been doing some work on this and found the PWM signal output is talbks_w and talbk_w (Duty cycle LBK signed and unsigned).

Then also found the H-bridge is a TLE7209 which has a input voltage range of 5-28v and max PWM frequency of 30khz. This would be plenty for our needs although id like to check where this is set in the file and potentially alter it if need be.

So we could alter talbk_w directly as LBK has been disabled in my file (RFD) so if we branch to a free space in ram then use pvdk_w and nmot_w with the output being talbk_w this would effectively be out duty cycle controlled from the ecu? then just some physical wiring to a mosfet so the pwm signal can be used to switch a high current feed without risk of damage to the IC although infinieon rate it at 5A max i think the pump would be around 5.8A but rather be safe than put stress on the ecu h-bridge.

So if the above is correct we just need to figure out how to alter the pwm frequency (to check its sufficiently high enough).

cheers

Logged
prj
Hero Member
*****

Karma: +903/-420
Offline Offline

Posts: 5787


« Reply #9 on: July 01, 2021, 12:55:19 AM »

WMI is best controlled by it's own controller with a failsafe system, which is tied into the ECU.
e.g. the Aquamist HFS-3.

This output could be used for controlling an additional bank of injectors in batch fire mode (probably will need a fast SSR on the output though). So what you are doing is definitely useful, just not for quite the right reason.
For controlling WMI, just buy the correct thing.

To see where that PWM goes in the end, you need to read the processor manual. To see which registers are responsible for the PWM period and duty.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #10 on: July 01, 2021, 12:16:04 PM »

WMI is best controlled by it's own controller with a failsafe system, which is tied into the ECU.
e.g. the Aquamist HFS-3.

This output could be used for controlling an additional bank of injectors in batch fire mode (probably will need a fast SSR on the output though). So what you are doing is definitely useful, just not for quite the right reason.
For controlling WMI, just buy the correct thing.

To see where that PWM goes in the end, you need to read the processor manual. To see which registers are responsible for the PWM period and duty.


Thanks, just been reading the MPC562 architecture and found some interesting modules on what registers are used to set pulse width and period. So the next question is where are these registers located? the document gives address's of MPWMSM0 Period Register (MPWMSMPERR) @ 0x306000 and MPWMSM0 Pulse Register (MPWMSMPULR) @ 0x306002

The flash is only 2mb so these address if absolute wouldn't be in the .bin but i guess there's an offset added that will send me too the right location? Looking at the memory map shows that MIOS14 is @ 0x00360000 so how do this?

attached is the memory map and other useful documents on the cpu architecture.
Logged
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #11 on: July 01, 2021, 12:17:27 PM »

Here's the memory map
Logged
prj
Hero Member
*****

Karma: +903/-420
Offline Offline

Posts: 5787


« Reply #12 on: July 02, 2021, 08:34:34 AM »

How could any system register possibly be in the flash?
The answer is: it can't.

These control registers are treated like RAM.
Find where the code writes to them. Maybe they are set up only once at boot and then only the actual value is written etc.

I never did this in MPC562, but I was fully successful at understanding how this works on C167.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
jacktfsi
Jr. Member
**

Karma: +18/-0
Offline Offline

Posts: 44


« Reply #13 on: July 02, 2021, 01:47:17 PM »

How could any system register possibly be in the flash?
The answer is: it can't.

These control registers are treated like RAM.
Find where the code writes to them. Maybe they are set up only once at boot and then only the actual value is written etc.

I never did this in MPC562, but I was fully successful at understanding how this works on C167.

Of course my bad! I have read the ram from 7F8000 and 800000 using an arduino and sparkfun so I’ll see if there’s any way I can do similar to read the area I need.

Thanks for the help prj, I’ll update when I make some more progress.
Logged
3Wtrs
Newbie
*

Karma: +3/-1
Offline Offline

Posts: 24


« Reply #14 on: August 02, 2021, 02:58:41 AM »

This output could be used for controlling an additional bank of injectors in batch fire mode (probably will need a fast SSR on the output though).

I love this idea. Has anyone ever realized that on MED9 or MED17?
Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.021 seconds with 16 queries. (Pretty URLs adds 0s, 0q)