V70user
Newbie
Karma: +2/-0
 Offline
Posts: 9
|
 |
« Reply #2625 on: June 01, 2024, 10:13:40 AM »
|
|
|
20FWHJ is very old software. You shouldn't touch ESKONF to disabl rear lambda. You should disable CDHSH, CDLSH and CDLASH. After Your answer I have a mess... How can I found CDHSH, CDLSH and CDLASH? Any hint...? I got only WinOLS, do I need some other sotware to modify/view a bin file? And this software hasn't 2d maps for fan mode. This software has some variables for different fan speeds. P80 A2L has these variables for fan. So you can find these variables by finding same maps in your software.
ok, but where to start? I have searched similar values You posted but no results. Maybe Im asking too much? |
|
|
|
|
Logged
|
|
|
|
|
s60rawr
|
|
« Reply #2626 on: June 02, 2024, 01:07:22 AM »
|
|
|
After Your answer I have a mess...
How can I found CDHSH, CDLSH and CDLASH? Any hint...? I got only WinOLS, do I need some other sotware to modify/view a bin file?
ok, but where to start? I have searched similar values You posted but no results. Maybe Im asking too much?
its decent for simple stuff. it has cdhsv i think. try that? 20FWHJ is very old software. You shouldn't touch ESKONF to disabl rear lambda. You should disable CDHSH, CDLSH and CDLASH.
And this software hasn't 2d maps for fan mode. This software has some variables for different fan speeds. P80 A2L has these variables for fan. So you can find these variables by finding same maps in your software.
finding cd / cw maps is a nightmare to find. i'll put some effort into it. i really need to lol |
|
|
|
« Last Edit: June 02, 2024, 01:15:50 AM by s60rawr »
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge! |
|
|
V70user
Newbie
Karma: +2/-0
Offline
Posts: 9
|
|
« Reply #2627 on: June 02, 2024, 06:00:33 AM »
|
|
|
finding cd / cw maps is a nightmare to find. i'll put some effort into it. i really need to lol
Thank You and really appreciate Your effort in maps searching |
|
|
|
|
Logged
|
|
|
|
V70user
Newbie
Karma: +2/-0
Offline
Posts: 9
|
|
« Reply #2628 on: June 03, 2024, 09:54:20 AM »
|
|
|
- deleted
|
|
|
|
« Last Edit: June 03, 2024, 10:37:00 AM by V70user »
|
Logged
|
|
|
|
V70user
Newbie
Karma: +2/-0
Offline
Posts: 9
|
|
« Reply #2629 on: June 03, 2024, 10:35:49 AM »
|
|
|
Thank You prometey1982 and s60rawr!
Two successes...
1. Rear lambda
- rear lambda sensor diagnostic CDLSH found at 0x1800B , enable 0x01, disable 0x00
- rear lambda heating diagnostic CDHSH found at 0x18004 , enable 0x01, disable 0x00
2. Decreasing engine fan starting temperature
I've found such a sequence of bytes: CC C0 E7 D3 D9 CF starting at 0x1882A
| | | | | |
on off on off on off
and for now I checked first two bytes CC C0 and it is TM1LF - engine temperature threshold 1 for cooling fan control step 1
CC = 204 dec (204*0.75)-48 = 105 C deg - fan starts
C0 = 192 dec (192 *0.75)-48 = 96 C deg - fan stops
I've changed these two bytes onto:
BF = 191 dec, it gives starting fan temperature = 95.25 C deg. In testing car fan started exactly at 96 C deg
B8 = 184 dec it is stoping fan temperature = 90 C deg. Fan stoped at 90 C deg .
and the sequence is: BF B8 E7 D3 D9 CF
So...I experimentally checked the operation of these settings. Analogically temperature can be increased if sb want to...
It should work for the rest bytes from this sequence , but I didn't check the other two pairs of bytes
It looks like CC C0 is a TM1LF and fan works at 25% speed,
I suspect that lower value bytes pair D9 CF is a TM2LF (50 % fan speed) and higher E7 D3 is a TM3LF (100% fan speed)
In this MY fan has 3 gears acording to ViDA, and it is matchig at least theoretically as it is written above
All these changes refers to software 20FWHJ from testing car V70 B5244T3 200hp, AT, 2WD, 2000 MY
|
|
|
|
« Last Edit: June 03, 2024, 11:59:45 AM by V70user »
|
Logged
|
|
|
|
|
s60rawr
|
|
« Reply #2630 on: June 04, 2024, 06:57:45 PM »
|
|
|
Thank You prometey1982 and s60rawr!
Two successes...
1. Rear lambda
- rear lambda sensor diagnostic CDLSH found at 0x1800B , enable 0x01, disable 0x00
- rear lambda heating diagnostic CDHSH found at 0x18004 , enable 0x01, disable 0x00
2. Decreasing engine fan starting temperature
I've found such a sequence of bytes: CC C0 E7 D3 D9 CF starting at 0x1882A
| | | | | |
on off on off on off
and for now I checked first two bytes CC C0 and it is TM1LF - engine temperature threshold 1 for cooling fan control step 1
CC = 204 dec (204*0.75)-48 = 105 C deg - fan starts
C0 = 192 dec (192 *0.75)-48 = 96 C deg - fan stops
I've changed these two bytes onto:
BF = 191 dec, it gives starting fan temperature = 95.25 C deg. In testing car fan started exactly at 96 C deg
B8 = 184 dec it is stoping fan temperature = 90 C deg. Fan stoped at 90 C deg .
and the sequence is: BF B8 E7 D3 D9 CF
So...I experimentally checked the operation of these settings. Analogically temperature can be increased if sb want to...
It should work for the rest bytes from this sequence , but I didn't check the other two pairs of bytes
It looks like CC C0 is a TM1LF and fan works at 25% speed,
I suspect that lower value bytes pair D9 CF is a TM2LF (50 % fan speed) and higher E7 D3 is a TM3LF (100% fan speed)
In this MY fan has 3 gears acording to ViDA, and it is matchig at least theoretically as it is written above
All these changes refers to software 20FWHJ from testing car V70 B5244T3 200hp, AT, 2WD, 2000 MY
Great work! |
|
|
|
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge! |
|
|
keichi
Full Member
Karma: +11/-2
Offline
Posts: 100
|
|
« Reply #2631 on: June 11, 2024, 03:59:32 AM »
|
|
|
2. Decreasing engine fan starting temperature
I've found such a sequence of bytes: CC C0 E7 D3 D9 CF starting at 0x1882A
| | | | | |
on off on off on off
and for now I checked first two bytes CC C0 and it is TM1LF - engine temperature threshold 1 for cooling fan control step 1
CC = 204 dec (204*0.75)-48 = 105 C deg - fan starts
C0 = 192 dec (192 *0.75)-48 = 96 C deg - fan stops
I've changed these two bytes onto:
BF = 191 dec, it gives starting fan temperature = 95.25 C deg. In testing car fan started exactly at 96 C deg
B8 = 184 dec it is stoping fan temperature = 90 C deg. Fan stoped at 90 C deg .
and the sequence is: BF B8 E7 D3 D9 CF
So...I experimentally checked the operation of these settings. Analogically temperature can be increased if sb want to...
It should work for the rest bytes from this sequence , but I didn't check the other two pairs of bytes
It looks like CC C0 is a TM1LF and fan works at 25% speed,
I suspect that lower value bytes pair D9 CF is a TM2LF (50 % fan speed) and higher E7 D3 is a TM3LF (100% fan speed)
In this MY fan has 3 gears acording to ViDA, and it is matchig at least theoretically as it is written above
All these changes refers to software 20FWHJ from testing car V70 B5244T3 200hp, AT, 2WD, 2000 MY
Its not that simple  You got TM1LF, TM2LF, TM3LF, TM6LF, TM7LF, TM8LF following byte constants starting from 0x1882A First 3 bytes are for fan step1, byte 4 for step2, byte 5 for step3. But its not only factor for fan control. Algorithm for fan control is actually quite complicated because it combine engine temperature control/air conditioning condenser temperature/EGT control/safety features/ECU temperature (yes! its for cooling processor like in ordinary PC somehow also, but don't ask me how and why, ask BOSCH engineers  There are way more constants and conditions (vehicle speed constants, A/C pressure constants, calculated EGT constants, many timers - from engine start, after engine stop, ECU temperature! and more...). One of the interesting parameters is temperature hysteresis DTMLF at 0x18781 (1byte) Fan rpm at steps 1/2/3 is also not constant. Actually its unknown ECU Doesn't set fan rpm but PWM signal to fan control module. PWM value depends on battery voltage. Its for example 50%@10V or 30%@14V to get fan step1. Maps for fan PWM are KLTVLFx (x=1/2/3) KLTVLF1 is at 0x1879C - 1dim table, axis right before data. For basic tune (simple stage1/2, daily usage car) all that matters is just TM1LF and TM2LF and maybe DTMLF. Just lower TM1/2 a bit like 5deg less and that's it. |
|
|
|
« Last Edit: June 11, 2024, 10:53:15 AM by keichi »
|
Logged
|
|
|
|
V70user
Newbie
Karma: +2/-0
Offline
Posts: 9
|
|
« Reply #2632 on: June 12, 2024, 03:55:13 AM »
|
|
|
For basic tune (simple stage1/2, daily usage car) all that matters is just TM1LF and TM2LF and maybe DTMLF. Just lower TM1/2 a bit like 5deg less and that's it.
...and that is what I've done in testing car. |
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #2633 on: July 01, 2024, 10:06:33 PM »
|
|
|
Попытка убрать ошибку по несоответствию контрольной суммы. Идеей является то, что мы можем посчитать контрольную сумму, но не отдавать ее CEM. Для этого необходимо убрать установку бита готовности контрольной суммы. Вот код из 50WRHJ: ROM:00056618 movb rl1, byte_30152A
ROM:0005661C jnb r1.6, loc_566A2
ROM:00056620 mov r12, chkstart_l_0
ROM:00056624 mov r13, chkstarth_w_0_0
ROM:00056628 mov r14, chkstop_l_0
ROM:0005662C mov r15, chkstoph_w_0_0
ROM:00056630 calls 5, sub_599B4
ROM:00056634 addb chksecm, rl4
ROM:00056638 mov r12, chkstop_l_0
ROM:0005663C mov r13, chkstoph_w_0_0
ROM:00056640 sub r12, chkstop_l
ROM:00056644 subc r13, chkstoph_w_0
ROM:00056648 jmpr cc_NZ, loc_56666
ROM:0005664A movbz r12, byte_30152A
ROM:0005664E and r12, #0FFBFh
ROM:00056652 mov r1, r12
ROM:00056654 movb byte_30152A, rl1
ROM:00056658 movbz r12, rl1
ROM:0005665A or r12, #10h // replace this line with two nop operations: 76 FC 10 00 -> CC 00 CC 00
ROM:0005665E mov r2, r12
ROM:00056660 movb byte_30152A, rl2
ROM:00056664 jmpr cc_UC, loc_566A2
На машине еще не проверял, возможно будет ругань от CEM на то, что контрольная сумма не посчитана. Но, мне кажется, ругаться не должно. Это же длительная операция и ответ в срок не гарантируется. |
|
|
|
« Last Edit: July 01, 2024, 10:09:07 PM by prometey1982 »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2634 on: July 02, 2024, 08:26:24 AM »
|
|
|
It's much simpler. Record the correct sum and inject it at end of calculation.
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #2635 on: July 03, 2024, 12:04:59 AM »
|
|
|
It's much simpler. Record the correct sum and inject it at end of calculation.
Good advice. Can be done by copying variable from the memory. And even if checksum is lost it can be found in 256 iterations. Need to log the bounds of checksum calculations. |
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #2636 on: July 06, 2024, 11:24:51 AM »
|
|
|
Хак не помог. CEM ругается на ошибку отсутствия ответа от ECM. Придется сохранять контрольную сумму и записывать в переменную.
|
|
|
|
|
Logged
|
|
|
|
V70_T5
Jr. Member
Karma: +1/-1
Offline
Posts: 28
|
|
« Reply #2637 on: July 07, 2024, 08:03:29 AM »
|
|
|
Is the Cruise Control Function at the P80 Me7 Cars activated by the ECU? (Different Bins with cruise / without?)
|
|
|
|
|
Logged
|
|
|
|
daniel2345
Full Member
Karma: +11/-8
Offline
Posts: 200
|
|
« Reply #2638 on: July 07, 2024, 08:09:26 AM »
|
|
|
No, configuration flag via can message from cdm.
|
|
|
|
|
Logged
|
|
|
|
V70_T5
Jr. Member
Karma: +1/-1
Offline
Posts: 28
|
|
« Reply #2639 on: July 07, 2024, 09:53:22 AM »
|
|
|
No, configuration flag via can message from cdm.
Thanks! |
|
|
|
|
Logged
|
|
|
|
|
