xM1ke
Newbie
Karma: +0/-0
 Offline
Posts: 16
|
 |
« Reply #2055 on: February 05, 2023, 08:18:43 AM »
|
|
|
I have an over-fuelling issue. I am targeting full throttle lambda with LAMFA, expecting KFLBTS + KFFDLBTS * KFDLBTS to take over if things get too hot (TABGBTS is still stock). However, I don’t get how this results in a requested lambda (lamsons) of 0.7 at 6600. Please find attached the log and (component protection) fuelling tables. https://datazap.me/u/m1ke/5-febr-ii?log=0&data=2-19-21-22-34&zoom=929-1035Btw, how safe is a calculated EGT of 870 degrees for a stage 1 car B5244T5? |
|
|
|
|
Logged
|
|
|
|
SparkyR
Full Member
Karma: +19/-21
Offline
Posts: 84
|
|
« Reply #2056 on: February 05, 2023, 08:57:07 AM »
|
|
|
I usually don’t let cars go higher than tabgbts of 900 for a car that’s in shimmed. If you are seeing 0.70 lambda and can’t find out why check your cwtatr this is your code word for catalyst over temp protection. 04 is active. The closer to 00 you make it this numbs the enrichment effect
|
|
|
|
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, 1300cc injectors
|
|
|
BaxtR
Full Member
Karma: +17/-25
Offline
Posts: 68
|
|
« Reply #2057 on: February 05, 2023, 03:45:11 PM »
|
|
|
On the topic of map packs, I wrote a tool to search for maps in my flash. Because there are several hundred, manually adding them is cumbersome. Is there some file format I can export them to, such as xml perhaps?
The idea is to import them in WinOLS.
any chance it would work with me7 or is it strictly denso? |
|
|
|
|
Logged
|
2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #2058 on: February 05, 2023, 04:11:41 PM »
|
|
|
any chance it would work with me7 or is it strictly denso?
Yes and more specifically, strictly Volvo Denso. It's just how it is I am afraid. I was originally trying to implement the map algo how it is in the code. The map descriptor table is in the following format. Interestingly, through the years, the start location is always 0x8614 in the 29LV200BC chip. map_flags - 4 byte X_bin_offset - 4 bytes. Y_bin_offset - 4 bytes - may not exist depending on bit flags and map type. map_addr - 4 bytes unknown_member - 4 bytes actually, the structure depends on map_flags's first byte and the bit flags, thus the map descriptor table is either 16 or 20 bytes per map. I was unable to deduce the bit flags pattern and thus my parser operates on some assumptions on my end. Some maps are generated at runtime and thus the map offsets point to RAM, most are static. I will soon attempt to flash my map changes, I have a few hurdles. One is that WinOLS Demo does not allow exporting of my changes and I have to use a hex editor, but that can be error prone. My second problem would be if the SBL I was provided which I know works on HN.2 ecus(but are from 2002, 2001), would or would not work on LE.2 which is 2005+. More specifically if it deletes the data from the flash but does not allow me to write to it. I am crossing my fingers on this one. Last is of course is why there are 4 pedal maps. It's still unclear, I am deducing at least one of them is for Winter mode, but I could be totally wrong. Other maps seem to modify the 1st and 3rd map between the 140hp and 170hp. I will do the same, I will copy the values as-is and the order of the maps. |
|
|
|
« Last Edit: February 05, 2023, 04:42:14 PM by dikidera »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +11/-2
Offline
Posts: 100
|
|
« Reply #2059 on: February 05, 2023, 05:17:42 PM »
|
|
|
I have an over-fuelling issue. I am targeting full throttle lambda with LAMFA, expecting KFLBTS + KFFDLBTS * KFDLBTS to take over if things get too hot (TABGBTS is still stock). However, I don’t get how this results in a requested lambda (lamsons) of 0.7 at 6600. Please find attached the log and (component protection) fuelling tables.
What is causing your over-fueling is ATR module and it is exhaust temperature protection. You can disable it by setting CATR to 0. But IMHO it's quite useful because it's time-delayed extra enrichment for longer pulls. Just reduce it by setting DLATRMN (Maximum negative delta AFR for EGT protection). I set it to 0,015 so i get some extra safety on longer puls. You have some weird factor for dlamatr_w. It should be SIGNED word with 0.000244141 factor. And don't mind calculated exhaust temperature - it's just very rough estimation for ECUs purposes. If you want to see real EGT just mount real sensor  |
|
|
|
« Last Edit: February 06, 2023, 01:25:44 AM by keichi »
|
Logged
|
|
|
|
daniel2345
Full Member
Karma: +11/-8
Offline
Posts: 200
|
|
« Reply #2060 on: February 06, 2023, 02:48:05 AM »
|
|
|
Volvo Denso for P2X has at least 5 different architectures.
There are 5 different factory SBL.
At least 7055 with and without external flash, early different CAN layout, different spi, bifuel, 7058.
For the first four it might be possible to construct a very smart one-fits-all SBL. but for 7058 it will probably not work. 7058 ist used from MY2005.
Then there are three more layouts for P80 and and two for P1X.
I have one repo for all and different build Configs for the specific ecus to keep track of all the differences. I would never use a one-fits-all SBL. Way too much risk sitting in car in the middle of nowhere with a dead ecu.
|
|
|
|
« Last Edit: February 06, 2023, 02:53:37 AM by daniel2345 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #2061 on: February 06, 2023, 04:10:46 AM »
|
|
|
I have the bi-fuel model, LE.2. From my tests it must be using 7055 simply because of the fact that my custom SBLs worked, which means at the very least the MMIO is correct.
On 7058 the MMIO for HCAN is
#define HCAN0 (*(volatile struct st_hcan2 *)0xFFFFD000)/* HCAN0 Address*/
#define HCAN1 (*(volatile struct st_hcan2 *)0xFFFFD800)/* HCAN1 Address*/
Which differs from 7055, but my custom written dumper SBL worked on BIFUEL with 7055 HCAN mmio. However this does not confirm whether the other write/erase SBL will work if the layout inside is different, pin-wise, because the SBL operates by pulsing the WE pin low on a per byte basis, unfortunately I was unable to map the physical connections of this circuit to the pins responsible.
If this differs even a bit from old HN.2 layout in the 2005 BIFUEL, it's very likely it will erase the chip, but never manage to write to it.
From my observations, the SBL first accepts the F8 command, which deletes the portion you want, by Sectors, each of which is a size of 0x8000 bytes(seems to be different depending on the sector). Then when you do write AE <data>, the data is actually not yet written, but is commited to a RAM address and as soon as you execute 7A 9C to set the new pointer, the handler of 9C finally writes the data, by pulsing the WE pin low however many bytes are written, and then sets the new pointer.
|
|
|
|
« Last Edit: February 06, 2023, 08:27:08 AM by dikidera »
|
Logged
|
|
|
|
xM1ke
Newbie
Karma: +0/-0
Offline
Posts: 16
|
|
« Reply #2062 on: February 06, 2023, 05:45:40 AM »
|
|
|
If you are seeing 0.70 lambda and can’t find out why check your cwtatr this is your code word for catalyst over temp protection. 04 is active. The closer to 00 you make it this numbs the enrichment effect
Thanks, so setting CWTATR to 00 will disable it. But IMHO it's quite useful because it's time-delayed extra enrichment for longer pulls.
Just reduce it by setting DLATRMN (Maximum negative delta AFR for EGT protection).
I set it to 0,015 so i get some extra safety on longer puls.
I believe the DLATRMN you are referring to is called DLATRNLN in my map pack (or maybe this is a different map, I do not have DLATRMN in my map pack). I see the stock value of DLATRNLN (desired delta lambda of exhaust temperature control substition) is -0.2969 at 6000 rpm. How does DLATRNLN enrich? Does it take the delta (difference) from the current lambda and does it enrich from there (e.g., from lambda 0.85 -> -0.2969 -> 0.55 (however, the limit is 0.7) -> 0.7, or does it take the delta from stoich 1.0 (1.0 -> 0.2969 -> 0.7)? |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2063 on: February 06, 2023, 08:48:57 AM »
|
|
|
The map you are referring to is the limp mode map in case of an error with ATR.
|
|
|
|
|
Logged
|
|
|
|
keichi
Full Member
Karma: +11/-2
Offline
Posts: 100
|
|
« Reply #2064 on: February 06, 2023, 11:00:18 AM »
|
|
|
Thanks, so setting CWTATR to 00 will disable it.
I believe the DLATRMN you are referring to is called DLATRNLN in my map pack (or maybe this is a different map, I do not have DLATRMN in my map pack).
I see the stock value of DLATRNLN (desired delta lambda of exhaust temperature control substition) is -0.2969 at 6000 rpm. How does DLATRNLN enrich? Does it take the delta (difference) from the current lambda and does it enrich from there (e.g., from lambda 0.85 -> -0.2969 -> 0.55 (however, the limit is 0.7) -> 0.7, or does it take the delta from stoich 1.0 (1.0 -> 0.2969 -> 0.7)?
DLATRNLN is fixed enrichment used in case of ATR error. DLATRMN is what limits ATR in normal operation. It was also around -0,3 in my stock bin (S60 T5 02). ATR turns on when modeled EGT>EGT_CONST (TABGSS?). ATR produces dlamatr_w that is directly added to lamfa or lambts (the lower one). Dlamatr_w is integrated (accumulated) with (EGT_CONST - modeled_EGT) and limited by DLATRMN. |
|
|
|
« Last Edit: February 06, 2023, 11:09:37 AM by keichi »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #2065 on: February 06, 2023, 05:20:20 PM »
|
|
|
CSV works for WinOLS. Attached is an example from here: https://tools.vehical.net/s18boostAnother thing you can do is take an A2L or DAM file if you have, write a parser for it and adjust the offsets in it (and delete those that you can't find). Then import this using the A2L import plugin. I was just about to write my code for CSV and then I saw the Demo does not support these features...bummer. Meanwhile, to export map changes from WinOLS Demo to binary, there is a harder way but it works. Change map to hexadecimal, 8 bit, and most importantly, remove all factors, signs whatever. Copy the map and paste into Notepad++, replace all tabs inside with a single space using the Replace All functionality. Then click on Extended and replace \r\n with a single space. Done. Copy the contents to the file by using a regular Hex Editor such as HxD. WinOLS seems to be protected by VMProtect/Denuvo. As expected, the similarities between VMProtect/Denuvo and SecuROM are uncanny. |
|
|
|
« Last Edit: February 06, 2023, 05:53:54 PM by dikidera »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +11/-2
Offline
Posts: 100
|
|
« Reply #2066 on: February 07, 2023, 03:55:07 AM »
|
|
|
Change map to hexadecimal, 8 bit, and most importantly, remove all factors, signs whatever. Copy the map and paste into Notepad++, replace all tabs inside with a single space using the Replace All functionality. Then click on Extended and replace \r\n with a single space. Done. Copy the contents to the file by using a regular Hex Editor such as HxD.
Probably the same work is defining maps in TunerPro which is free I find and define maps in WinOLS demo and then redefine those i need to modify in TunerPro. OLS files seems not too complicated to reverse engineer its format and make some custom OLS->XDF or whatever converter but i find it just faster and easier to manually define maps i need in TunerPro. But maybe someone managed to make some tool to export OLS file Would be great. |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2067 on: February 07, 2023, 05:09:30 AM »
|
|
|
There is a built in XDF export plugin.
Stop talking about cracked shit on here. This server is in the US. Tony is AWOL.
One DMCA notice and we are going to lose this forum.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #2068 on: February 07, 2023, 05:35:10 AM »
|
|
|
There is a built in XDF export plugin.
Stop talking about cracked shit on here. This server is in the US. Tony is AWOL.
One DMCA notice and we are going to lose this forum.
No one is talking about cracked software here. Merely an observation. So wait, you are saying this forum has no active admin? |
|
|
|
« Last Edit: February 07, 2023, 05:37:55 AM by dikidera »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2069 on: February 07, 2023, 06:50:37 AM »
|
|
|
So wait, you are saying this forum has no active admin? Correct. |
|
|
|
|
Logged
|
|
|
|
|
