Hi Guys,

I've been playing with med9 for some time and wanted a new project to keep my brain active and also potentially benefit my car in some way.

My idea was to use the intake runner flap pwm output and wire this to a h bridge controller so i can control a water meth pump using the oem ecu. I was thinking of creating a 3d map based on pvdr/nmot_w with the Z axis being duty cycle of pump. Things like IAT could also be used as compensation and even adding feedback to the rear o2 to let you know the tanks empty and switch back to a safer kfzw etc.

But although the idea seems OK in my head i'm struggling to do 1 very important thing and that's locate the variables for these outputs in the stock ram. I've found the pin numbers from the FR after reading the STECK and STEGO section and i believe the PWM output for the flaps is A35 A_T_LBKPWM1 - Then after disassembling the bin i found the variable for the setpoint for flap position which is 7FC39C in my file. This is where i'm struggling as with it being a pwm output this will be configured somewhere in the bin to set the frequency but I've no experience in using or modifying existing outputs to potentially change its operating frequency to suit needs (probably not needed) or actually locate the exact variable i need to control and output my duty cycle too.

I can create the maps and patch the rest in and i'm wanting to share the project to help others but just need that nudge in the right direction to help get the project moving. I have some knowledge of med9 and powerPC disassembly and have done mapswitching, launch control etc so it should be a feasible task.

FYI im not doing this to be 'cheap' its just purely an interest of mine and i like creating things myself if possible.

Hopefully the right people can help - Cheers

Hi,

Yes that’s a good idea and I’m sure it’s been done before. Similar to my own project too and I’d definitely be interested in helping! First things first we need to locate the variable and it’s configuration with regards to pwm frequency in the binary. So the whatever gives its final output to A_T_LBKPWM - this could be really simple and it could be the variable I’ve stated but I’m not sure although I will test it and try and see what happens.

If you can find this then I’m sure it will be a big help for both of us.

Hi, I'll use this file as i have an A2L for it. My car is 115T but I don't have an a2l and things are much easier with one so if we crack it on 115H I will be able to figure out where everything goes on 115T as they're similar.

If you need the A2L for 115H let me know and ill post it.

Here's the A2L...

So been doing some work on this and found the PWM signal output is talbks_w and talbk_w (Duty cycle LBK signed and unsigned).

Then also found the H-bridge is a TLE7209 which has a input voltage range of 5-28v and max PWM frequency of 30khz. This would be plenty for our needs although id like to check where this is set in the file and potentially alter it if need be.

So we could alter talbk_w directly as LBK has been disabled in my file (RFD) so if we branch to a free space in ram then use pvdk_w and nmot_w with the output being talbk_w this would effectively be out duty cycle controlled from the ecu? then just some physical wiring to a mosfet so the pwm signal can be used to switch a high current feed without risk of damage to the IC although infinieon rate it at 5A max i think the pump would be around 5.8A but rather be safe than put stress on the ecu h-bridge.

So if the above is correct we just need to figure out how to alter the pwm frequency (to check its sufficiently high enough).

cheers

Thanks, just been reading the MPC562 architecture and found some interesting modules on what registers are used to set pulse width and period. So the next question is where are these registers located? the document gives address's of MPWMSM0 Period Register (MPWMSMPERR) @ 0x306000 and MPWMSM0 Pulse Register (MPWMSMPULR) @ 0x306002

The flash is only 2mb so these address if absolute wouldn't be in the .bin but i guess there's an offset added that will send me too the right location? Looking at the memory map shows that MIOS14 is @ 0x00360000 so how do this?

attached is the memory map and other useful documents on the cpu architecture.

How could any system register possibly be in the flash?
The answer is: it can't.

These control registers are treated like RAM.
Find where the code writes to them. Maybe they are set up only once at boot and then only the actual value is written etc.

I never did this in MPC562, but I was fully successful at understanding how this works on C167.

I love this idea. Has anyone ever realized that on MED9 or MED17?