dikidera
Full Member
Karma: +8/-8
 Offline
Posts: 149
|
 |
« Reply #2070 on: February 05, 2023, 04:11:41 PM »
|
|
|
any chance it would work with me7 or is it strictly denso?
Yes and more specifically, strictly Volvo Denso. It's just how it is I am afraid. I was originally trying to implement the map algo how it is in the code. The map descriptor table is in the following format. Interestingly, through the years, the start location is always 0x8614 in the 29LV200BC chip. map_flags - 4 byte X_bin_offset - 4 bytes. Y_bin_offset - 4 bytes - may not exist depending on bit flags and map type. map_addr - 4 bytes unknown_member - 4 bytes actually, the structure depends on map_flags's first byte and the bit flags, thus the map descriptor table is either 16 or 20 bytes per map. I was unable to deduce the bit flags pattern and thus my parser operates on some assumptions on my end. Some maps are generated at runtime and thus the map offsets point to RAM, most are static. I will soon attempt to flash my map changes, I have a few hurdles. One is that WinOLS Demo does not allow exporting of my changes and I have to use a hex editor, but that can be error prone. My second problem would be if the SBL I was provided which I know works on HN.2 ecus(but are from 2002, 2001), would or would not work on LE.2 which is 2005+. More specifically if it deletes the data from the flash but does not allow me to write to it. I am crossing my fingers on this one. Last is of course is why there are 4 pedal maps. It's still unclear, I am deducing at least one of them is for Winter mode, but I could be totally wrong. Other maps seem to modify the 1st and 3rd map between the 140hp and 170hp. I will do the same, I will copy the values as-is and the order of the maps. |
|
|
|
« Last Edit: February 05, 2023, 04:42:14 PM by dikidera »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2071 on: February 05, 2023, 05:17:42 PM »
|
|
|
I have an over-fuelling issue. I am targeting full throttle lambda with LAMFA, expecting KFLBTS + KFFDLBTS * KFDLBTS to take over if things get too hot (TABGBTS is still stock). However, I don’t get how this results in a requested lambda (lamsons) of 0.7 at 6600. Please find attached the log and (component protection) fuelling tables.
What is causing your over-fueling is ATR module and it is exhaust temperature protection. You can disable it by setting CATR to 0. But IMHO it's quite useful because it's time-delayed extra enrichment for longer pulls. Just reduce it by setting DLATRMN (Maximum negative delta AFR for EGT protection). I set it to 0,015 so i get some extra safety on longer puls. You have some weird factor for dlamatr_w. It should be SIGNED word with 0.000244141 factor. And don't mind calculated exhaust temperature - it's just very rough estimation for ECUs purposes. If you want to see real EGT just mount real sensor  |
|
|
|
« Last Edit: February 06, 2023, 01:25:44 AM by keichi »
|
Logged
|
|
|
|
daniel2345
Full Member
Karma: +11/-7
Offline
Posts: 197
|
|
« Reply #2072 on: February 06, 2023, 02:48:05 AM »
|
|
|
Volvo Denso for P2X has at least 5 different architectures.
There are 5 different factory SBL.
At least 7055 with and without external flash, early different CAN layout, different spi, bifuel, 7058.
For the first four it might be possible to construct a very smart one-fits-all SBL. but for 7058 it will probably not work. 7058 ist used from MY2005.
Then there are three more layouts for P80 and and two for P1X.
I have one repo for all and different build Configs for the specific ecus to keep track of all the differences. I would never use a one-fits-all SBL. Way too much risk sitting in car in the middle of nowhere with a dead ecu.
|
|
|
|
« Last Edit: February 06, 2023, 02:53:37 AM by daniel2345 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2073 on: February 06, 2023, 04:10:46 AM »
|
|
|
I have the bi-fuel model, LE.2. From my tests it must be using 7055 simply because of the fact that my custom SBLs worked, which means at the very least the MMIO is correct.
On 7058 the MMIO for HCAN is
#define HCAN0 (*(volatile struct st_hcan2 *)0xFFFFD000)/* HCAN0 Address*/
#define HCAN1 (*(volatile struct st_hcan2 *)0xFFFFD800)/* HCAN1 Address*/
Which differs from 7055, but my custom written dumper SBL worked on BIFUEL with 7055 HCAN mmio. However this does not confirm whether the other write/erase SBL will work if the layout inside is different, pin-wise, because the SBL operates by pulsing the WE pin low on a per byte basis, unfortunately I was unable to map the physical connections of this circuit to the pins responsible.
If this differs even a bit from old HN.2 layout in the 2005 BIFUEL, it's very likely it will erase the chip, but never manage to write to it.
From my observations, the SBL first accepts the F8 command, which deletes the portion you want, by Sectors, each of which is a size of 0x8000 bytes(seems to be different depending on the sector). Then when you do write AE <data>, the data is actually not yet written, but is commited to a RAM address and as soon as you execute 7A 9C to set the new pointer, the handler of 9C finally writes the data, by pulsing the WE pin low however many bytes are written, and then sets the new pointer.
|
|
|
|
« Last Edit: February 06, 2023, 08:27:08 AM by dikidera »
|
Logged
|
|
|
|
xM1ke
Newbie
Karma: +0/-0
Offline
Posts: 14
|
|
« Reply #2074 on: February 06, 2023, 05:45:40 AM »
|
|
|
If you are seeing 0.70 lambda and can’t find out why check your cwtatr this is your code word for catalyst over temp protection. 04 is active. The closer to 00 you make it this numbs the enrichment effect
Thanks, so setting CWTATR to 00 will disable it. But IMHO it's quite useful because it's time-delayed extra enrichment for longer pulls.
Just reduce it by setting DLATRMN (Maximum negative delta AFR for EGT protection).
I set it to 0,015 so i get some extra safety on longer puls.
I believe the DLATRMN you are referring to is called DLATRNLN in my map pack (or maybe this is a different map, I do not have DLATRMN in my map pack). I see the stock value of DLATRNLN (desired delta lambda of exhaust temperature control substition) is -0.2969 at 6000 rpm. How does DLATRNLN enrich? Does it take the delta (difference) from the current lambda and does it enrich from there (e.g., from lambda 0.85 -> -0.2969 -> 0.55 (however, the limit is 0.7) -> 0.7, or does it take the delta from stoich 1.0 (1.0 -> 0.2969 -> 0.7)? |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2075 on: February 06, 2023, 08:48:57 AM »
|
|
|
The map you are referring to is the limp mode map in case of an error with ATR.
|
|
|
|
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2076 on: February 06, 2023, 11:00:18 AM »
|
|
|
Thanks, so setting CWTATR to 00 will disable it.
I believe the DLATRMN you are referring to is called DLATRNLN in my map pack (or maybe this is a different map, I do not have DLATRMN in my map pack).
I see the stock value of DLATRNLN (desired delta lambda of exhaust temperature control substition) is -0.2969 at 6000 rpm. How does DLATRNLN enrich? Does it take the delta (difference) from the current lambda and does it enrich from there (e.g., from lambda 0.85 -> -0.2969 -> 0.55 (however, the limit is 0.7) -> 0.7, or does it take the delta from stoich 1.0 (1.0 -> 0.2969 -> 0.7)?
DLATRNLN is fixed enrichment used in case of ATR error. DLATRMN is what limits ATR in normal operation. It was also around -0,3 in my stock bin (S60 T5 02). ATR turns on when modeled EGT>EGT_CONST (TABGSS?). ATR produces dlamatr_w that is directly added to lamfa or lambts (the lower one). Dlamatr_w is integrated (accumulated) with (EGT_CONST - modeled_EGT) and limited by DLATRMN. |
|
|
|
« Last Edit: February 06, 2023, 11:09:37 AM by keichi »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2077 on: February 06, 2023, 05:20:20 PM »
|
|
|
CSV works for WinOLS. Attached is an example from here: https://tools.vehical.net/s18boostAnother thing you can do is take an A2L or DAM file if you have, write a parser for it and adjust the offsets in it (and delete those that you can't find). Then import this using the A2L import plugin. I was just about to write my code for CSV and then I saw the Demo does not support these features...bummer. Meanwhile, to export map changes from WinOLS Demo to binary, there is a harder way but it works. Change map to hexadecimal, 8 bit, and most importantly, remove all factors, signs whatever. Copy the map and paste into Notepad++, replace all tabs inside with a single space using the Replace All functionality. Then click on Extended and replace \r\n with a single space. Done. Copy the contents to the file by using a regular Hex Editor such as HxD. WinOLS seems to be protected by VMProtect/Denuvo. As expected, the similarities between VMProtect/Denuvo and SecuROM are uncanny. |
|
|
|
« Last Edit: February 06, 2023, 05:53:54 PM by dikidera »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2078 on: February 07, 2023, 03:55:07 AM »
|
|
|
Change map to hexadecimal, 8 bit, and most importantly, remove all factors, signs whatever. Copy the map and paste into Notepad++, replace all tabs inside with a single space using the Replace All functionality. Then click on Extended and replace \r\n with a single space. Done. Copy the contents to the file by using a regular Hex Editor such as HxD.
Probably the same work is defining maps in TunerPro which is free I find and define maps in WinOLS demo and then redefine those i need to modify in TunerPro. OLS files seems not too complicated to reverse engineer its format and make some custom OLS->XDF or whatever converter but i find it just faster and easier to manually define maps i need in TunerPro. But maybe someone managed to make some tool to export OLS file Would be great. |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2079 on: February 07, 2023, 05:09:30 AM »
|
|
|
There is a built in XDF export plugin.
Stop talking about cracked shit on here. This server is in the US. Tony is AWOL.
One DMCA notice and we are going to lose this forum.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2080 on: February 07, 2023, 05:35:10 AM »
|
|
|
There is a built in XDF export plugin.
Stop talking about cracked shit on here. This server is in the US. Tony is AWOL.
One DMCA notice and we are going to lose this forum.
No one is talking about cracked software here. Merely an observation. So wait, you are saying this forum has no active admin? |
|
|
|
« Last Edit: February 07, 2023, 05:37:55 AM by dikidera »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2081 on: February 07, 2023, 06:50:37 AM »
|
|
|
So wait, you are saying this forum has no active admin? Correct. |
|
|
|
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2082 on: February 07, 2023, 06:51:13 AM »
|
|
|
There is a built in XDF export plugin.
Stop talking about cracked shit on here. This server is in the US. Tony is AWOL.
One DMCA notice and we are going to lose this forum.
There was no single word about any cracked software. WinOLS demo is free. TunerPro is also free. EVC is German company. How would they "hurt" this forum in any way and why would they do that in the first place? Opening OLS file in third party software (hex editor, script) and looking at it is not a crime or is it? |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2083 on: February 07, 2023, 06:57:54 AM »
|
|
|
There was no single word about any cracked software.
WinOLS demo is free.
TunerPro is also free. Free as in beer does not grant you the right to reverse engineer or modify the software. EVC is German company. How would they "hurt" this forum in any way and why would they do that in the first place? By filing a DMCA notice, it does not matter that they are a German company. Opening OLS file in third party software (hex editor, script) and looking at it is not a crime or is it? Anti-circumvention clauses of the DMCA prohibit circumvention of “technical protection means”, that limit access to the copyrighted work. Having OLS files in an obfuscated and encrypted format is certainly a technical protection. Not being able to export things from the demo, is again a protection and bypassing it falls under this clause. Reverse engineering OLS and making an OLS -> XDF converter, which EVC actually sells for 150 EUR is also a great way to get the wrong kind of attention. If you are not familiar with DMCA and do not have experience with it, then hush. It can be used without any legal grounds by the copyright holder and it is up to the admin to prove it is not the case. Until the admin does that any ISP in the US immediately takes the site down, and does not put it back up until the content is removed. If they don't, they can get sued. Having been on the receiving end of the stick, it's not a fun thing, and fighting it is usually a waste of time. Since we don't have an active admin, if it gets taken down, then it might be down for weeks or months. I've actually thought about dumping this forum and re-hosting it somewhere, and giving some people actual full access to the server itself, so it does not suddenly go the way of the dodo. |
|
|
|
« Last Edit: February 07, 2023, 07:03:04 AM by prj »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2084 on: February 07, 2023, 07:14:30 AM »
|
|
|
If you are not familiar with DMCA and do not have experience with it, then hush. It can be used without any legal grounds by the copyright holder and it is up to the admin to prove it is not the case.
Until the admin does that any ISP in the US immediately takes the site down, and does not put it back up until the content is removed. If they don't, they can get sued.
Having been on the receiving end of the stick, it's not a fun thing, and fighting it is usually a waste of time.
Since we don't have an active admin, if it gets taken down, then it might be down for weeks or months.
I've actually thought about dumping this forum and re-hosting it somewhere, and giving some people actual full access to the server itself, so it does not suddenly go the way of the dodo.
I am from Europe. I didn't know that anyone can take down any site they want in US. I remember they wanted to force similar law some time ago here (called ACTA) but people walked out on the streets doing protests and the government backed off reluctantly. At least for now. |
|
|
|
|
Logged
|
|
|
|
|
