Opel corsa rev limit and xdf help, basic xdf added

[delboy]

Hi all, on my little project Ive managed to find and define all the fuel and spark maps Ive needed so far, I dont use ida just hex editor and existing xdfs with thier bins by recognising the patterns mainly in 2d with winols demo. I am completely stumped on the rev limit though, people have told me on other forums the addresses 01221 and 01223 are it but Ive played with the values and still limits. Ive also learned that the limit is a 16bit value and the rpm = a constant dived by the 16bit value.
Anybody any hints such as the constant? Ive attached the file, its a holden barina/opel corsa 1.2 8v spi x12sz, it has a coil pack ignition and the limit would be around 6250, it is used on track and ethier standard carb or spi must be used in case anyone wonders why I bother with it lol. Thanks in advance.

[VL400]

Welcome along, have attached a disassembly of your bin. It might make it easier to find the rev limit code.

Do you know any of the ALDL stream? Finding the RPM RAM address would be a good starting point.

[ikarus_nu]

the limit is composed by two values, at least in my car Opel Astra mk4, one value is the maximum rev limit, when the engine arrives this rpm, ECU cuts fuel/spark until rpms fall below a lower rev limit.

[delboy]

Thanks everyone, I'm still reading around the forum, I'm a noob to this disassembly, also aldl I've just used my diagnostics tool without ever looking at how it works and found the maps by hours of staring at hex and xdf text
Could anyone point me in the direction of some reading to start me off? I've googled and looked briefly at ida tutorials is this a good place to start? It looks scary now.

[VL400]

If you can post the location of the fuel and spark maps it will make it easier - if you have started an XDF then post that up. From the location you can find the code that does the lookup and from that the RPM and MAP (or MAF?) RAM locations. There is no real tutorial on how to work through the code, its all just hard work and using the small snippets of info thats available for the particular code base or from other disassemblies - an ALDL stream definition is probably the single most useful bit of info to start with as it will define many major RAM locations.

[charlay86]

VL400, how does the aldl stream relate to the ram addresses typically?

[antus]

you trace the serial rx interrupt, to the aldl hander, to the mode 1 routine, and see where it gathers the data from. since you know what the data is in the aldl stream, there you have your ram locations. Then you look at the code that uses the data in ram, and try to figure it out.

[delboy]

Wow, more help here than anywhere else, hopefully one day I can contribute something back! I'm not familiar with tunerpro but have got it, now I read theres trace function with it? I'll look at making an xdf and using tunerpro tonight and invest in the moates emulator, I'll get my work laptop on shortly and post all my findings and map locations as well. Thanks

[ivanovbg]

const.calc.break-3932490
V-enginе speed -7000
C/V = rev limit
3932490/7000=561,.... in hex 231
001221 -02
001222 -31
001223 -02
001224 -31


Tell how I can help
My English is bad translate with google

[ivanovbg]

map locations-
00D1-injection at part throttle 16X11
0AF3-spark advance at close throttle 7X9
do you and other
my skype is -ivanovbg1
then send the result here