Pages: [1]
Author Topic: me7.3.1 turbo KFVPLGU and plgru_w  (Read 2784 times)
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« on: November 14, 2022, 06:17:25 PM »

So this is the first time i am actualy trying to tune for power this ecu. the only modification that this engine has is a diferent turbo, and with that a diferent waste gate crancking pressure.

I am using nefmoto flasher to log with kwp2000 read by memory adress.

i have this ecu almost completely defined in winols and i also have dissasembled it in ida to try to found out some codewords, ram adresses, etc.
Long story short, this ecu is almost like the alfa me7.3.1 except the turbo related maps, that are almost like the audi S4 me7.1.1

So the basic problem here is that this ecu uses plgru as wastegate cranking pressure not pu_w for kfldimx. I did not realize that until i was tunning the car trying to get the boost under control.

looking at the logs, ldtv, ldtvr, ldimxa, ldimxr, nothing made sense, so i decided to take a closer look and then realized what was my mistake.
So cwldimx is 0, so plsolr is the diference between plsol and plgrus.

How do i go about this?
set cwldimx to 1 and scale kfldimx and kfldiopu to reflecte the changes or try to mess with kfvplgu to get the cranking pressure right.

Just as a reference, this ecu uses the "trick" as the rs4 and rs6 when it comes to kfldimx and kfldrl, as you can see kfldimx is linear.

also i dont know if my axis scale is right in kfvplgu. i will leave screenshots of the dissassembled file and winols maps.

Thanks
« Last Edit: November 14, 2022, 06:20:13 PM by fragolas » Logged
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #1 on: November 15, 2022, 08:15:24 PM »

and the rabit hole keeps getting deeper...

so after some searching and reading the fr i came to the conclusion that cwplgu is set to 0. as this is a compile time option on my ecu, only asm hack would change this. So has it happens, or so i thought plgru would also be present in the axis calculations of kfvpdksd/e, as is in the rs4 for example.

But no, fiat decided to do diferently.

If i am correct, plgru (from KFVPLGU) is only used in KFLDIMX, in kfvpdksd/e they decided to use pu (atmospheric pressure) for the axis(minus pssol) or in other words vpsspu.

Thanks fiat for being diferent  Angry

Now i will make my lianiarization runs and trying to get this crap on point. i will also take a look at WDKUGDN to make sure i dont have problems.

maps and assembly for anyone to take a look.
Logged
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #2 on: April 05, 2023, 04:32:34 AM »

to anyone that wants to tune this ecu or a similiar one here is a little guide:

first things first, set cwmdapp to 8 (as this sets LDTVMA in application mode), then set kfldrapp to all 0, so that we can get a base boost pressure

do a pull and log boost till redline, after this set kfldrapp in increments of 10 till 95% and do the same ( beaware of excessive boost, dont blow your engine)

after having the the logs its time to actualy get to work. this ecu uses KFVPLGU( this is the base boost map) and KFWPLGTA( base boost correction based on IAT).

KFVPLGU is a multiplier for pu (atmopheric pressure) and outputs plgru and KFWPLGTA is again a multiplier for plgru, this then used in kfldimx (pssol - plgru).

Stock , fiat decided to use KFVPLGU and left KFWPLGTA all 1's, now its the time to decide how you want to do things, you can fill KFVPLGU all 1's and plgru =pu, or use base boost as plgru and tune kfldimx/kfldrl accordingly. I decided to use the same methotd as Fiat.

So grab the log of your kfldrapp all 0's and fill your KFVPLGU, the axis is pssol, so only fill your base boost based on the log from 1000 up, values below i used the same percentage difference as the original.

now with kfldimx/kfldrl:

Fiat decided to use the same "hack" as in the rs4/rs6, so kfldimx is perfectly linear and kfldrl is per say, your wastegate duty cycle pre control map.
Because i decided to use KFVPLGU, i made a simple excel with automates a bit of the work, you still need to use your brain, but it makes the job easier as it subtracts your logged boost presure from your base boost and also has a function to do some linear interpolation ( keep in mind turbo wastegate response is not linear, so use your head). in the cells where you cant make any boost fill with 95, so that you can spool has hard as possible.

after having set your kfldrl in the ballpark, also make changes in KFLDHBN if necessary.

As i said in a earlier post, KFVPDKSD and KFVPDKSE in this ecu uses vpsspu_w (pssol - pu), so also change your values based on base boost so the ecu knows where to open the trottle completely and use wastegate to control load and where it need to control load with throtle, especialy important in the transition where your turbo actualy starts to spool up.

finaly flash you ecu and log rpm(nmot), boost(pvdkds_w), requested boost(plsol_w), wastegate duty cycle(ldtv) and wastegate ducty cycle pid correction(ldimxak_w).
Drive the car and watch out for any areas where boost is below or above requested, and pay close attention to how much is the pid value.

finaly grab this final log and do your final kfldrl, you can use the same excel spredsheet.

after all this you should have your actual boost following requested, Good job.

i will leave my excel spreadsheet, my ecu map pack, and my definition file of the variables that you need to log, keep in mind i used nefmoto logger to log this ecu, using readmemorybyadress, as there is no vehical logger or me7logger for this, so i had to manualy set the location of all my ram variables and their scale, etc.

hope this is helpfull for someone.
« Last Edit: April 05, 2023, 04:34:33 AM by fragolas » Logged
prj
Hero Member
*****

Karma: +1072/-485
Offline Offline

Posts: 6040


« Reply #3 on: April 05, 2023, 06:29:47 AM »

Good job.
I did a 166 3.2L with a supercharger in 2018, this brings back some memories...
I also used ReadMemoryByAddress and I remember it being extremely slow.

Have not looked at the comms stack on these, but chances are they need a custom service injected as a patch to have better logging.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #4 on: April 05, 2023, 03:41:55 PM »

when you talk about comms stack you mean something like this? its the diagnostics table, it contains the various variables that can be logged using something like multiecuscan. i imagine multiecuscan uses readDataByLocalIdentifier. with some trickery and good coding skills, the ram locations of these variables can be retrived automaticly, as this table is preaty much the same between all me7.3.1 that i know of.

as far as logging speed using readmemorybyadress, i get a sample rate of 30 to 40 samples per second, and when the variables are one after another ( for instance, cylinder n1 knock, n2, etc, Dwkrz_X) i use contiguous variables per second, so with one request i can get all 5 samples. its not the fastest thing ever, but it can produce good results. i wil leave my p1,p2,p3 and p4 timmings (this values come from an internal document of fiat about their kwp2000 service).
Logged
prj
Hero Member
*****

Karma: +1072/-485
Offline Offline

Posts: 6040


« Reply #5 on: April 05, 2023, 04:17:05 PM »

LID table is not interesting... finding variables is a solved problem for me - 1 click and 5 seconds later I have over 90% of them, as long as there is at least one similar A2L around.
You have to look at which services are supported and if a custom handler can be injected into RAM like on VAG ME7 or if you have to make a patch to inject a custom service.

Anyway, I'm not gonna work on it, no demand.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #6 on: April 08, 2023, 07:45:03 PM »

There's me, there is at least 0.01% demand Grin
Jokes aside, I did read your exploit to log me7, but I can't run before I can walk and implementing something like that is like running a marathon to me. Maybe in the future.

For now the first thing will be to write a script to convert XML log of nefmoto logger to csv, and then I will try to write my own logger based on nefmoto logger source code.
Logged
prj
Hero Member
*****

Karma: +1072/-485
Offline Offline

Posts: 6040


« Reply #7 on: April 11, 2023, 12:01:52 PM »

Nefmoto not very useful, $23 is mega slow.
You can adjust my handler a little, dump it in the flash and change the SNS pointer permanently.

I have ME7.9.10, but that has native open CCP, so it does not even need any patching/hacking for 100hz logging.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #8 on: April 11, 2023, 01:00:19 PM »

I do understand what you're saying, but I have to start from somewhere... My degree is in mechanical engineering, not computer science.

Just learning how to read(a bit) of assembly, how a microcontroller (c167) works, getting around the fr, identifying maps, how the kwp2000 protocol works, programing some scripts in python, etc took me a lot of my spare time.

I hope I can achieve something like what you're saying, but that is still a steep incline for me.

Enviado do meu M2102J20SG através do Tapatalk

Logged
prj
Hero Member
*****

Karma: +1072/-485
Offline Offline

Posts: 6040


« Reply #9 on: April 11, 2023, 04:23:06 PM »

You're already doing better than most.
Btw, nefmoto logger source code is extremely hard to read. I also recommend using a J2534 device instead of KKL, it handles all the timing correctly for you and the five baud and fast init.

If you get familiar with the API you can also easily transition to CAN based controllers from there, should the need arise.
The KKL is a dead end.
« Last Edit: April 11, 2023, 04:24:39 PM by prj » Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
fragolas
Jr. Member
**

Karma: +17/-0
Offline Offline

Posts: 39


« Reply #10 on: April 16, 2023, 03:50:30 PM »

I have downloaded the tactrix open port software and examples that they have and taken a look at the api. I also downloaded the j2534 document to look at how it works. Even for a total noob like me it does indeed look to make life a little bit easier. Still, i think this is bit more than i can chew, but i will give it a try.
I will order a openport, i dont need multiplex so i guess i dont need a scanmatik.

Time to get really good at C  Tongue

Thanks for the guidelines.
Logged
prj
Hero Member
*****

Karma: +1072/-485
Offline Offline

Posts: 6040


« Reply #11 on: April 16, 2023, 07:02:21 PM »

I have downloaded the tactrix open port software and examples that they have and taken a look at the api. I also downloaded the j2534 document to look at how it works. Even for a total noob like me it does indeed look to make life a little bit easier. Still, i think this is bit more than i can chew, but i will give it a try.
I will order a openport, i dont need multiplex so i guess i dont need a scanmatik.

Time to get really good at C  Tongue

Thanks for the guidelines.
You can use C# with this library, I use it for my logger as well:
https://github.com/BrianHumlicek/J2534-Sharp

All you need to do to connect to your ECU is just FastInit, read and set the timing parameters and you're good to go.
The J2534 device will handle the checksums for you as well. You can just write directly. It's infinitely easier than doing it on a COM port.

Also, the OP2 is far from being a good device. It's cheap, but it breaks the spec in more ways than one. Enough for you though Smiley
Scanmatik is a much better device, but the price reflects it of course.

« Last Edit: April 16, 2023, 07:09:46 PM by prj » Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.02 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)