developing a spark cut launch control solution

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
User avatar
Posts: 22
Joined: Fri Feb 28, 2014 7:38 am

developing a spark cut launch control solution

Postby vwnut8392 » Wed Feb 20, 2019 2:06 pm

I recently started into gen 3 GM ECU's after swapping an 81 C10 with a 6.0 from an express. turbo is in the future for the truck so i went searching for a spark cut launch control solution. HPtuners does nothing and it seems there is no true in ECU solution for this so i feel a need to develop a solution. To start im no stranger to developing stuff like this for german cars as thats where i originally come from. i have worked on in ECU spark cut launch control and 2 step spark/fuel cut RPM limiters for several different versions of the bosch motronic over the years.

This ECU is a whole new ball game to me and im not sure where to start with a disassembly of the flash or where to get a full read of the flash. i could get a spare P59 ECU, unsolder the flash i guess and read it manually in my eeprom programmer as i see that this ECU uses the sam AM29F800BB chip as VW/audi motronic 7 ECU's. I seen the PCM hammer open source software and im really interested in it as well but im not exactly sure which reflash cables support it. PCM hammer would be a great tool for doing test flashes! Not sure if anyone has a done disassembly on the P59 with ida pro yet but if someone did or had some pointers on getting the RAM layout setup would be great.

As for spark cut anything its actually semi simple to achieve depending on how the ECU works. There are several ways that it could be done like forcing the ignition angle to a different a different constant value at a certain RPM value than when the false value is pushed into RAM the engine will spark cut causing the RPM to drop below the spark cut RPM. you essentially end up with a code function that bounces between false value and real value so you get that fast on/off like found in standalone ECU's. Now if you would want this to build boost faster you could add timing retard 500-1000 RPM before the spark cut RPM and holding the timing retard during launch. that would most definitely give that loud backfiring and flames out of the exhaust lol. Another way i have seen spark cut achieved is to modify the actual crank angle sensor value in RAM. by feeding it the ECU techincally the wrong value for where the crank angle actually is you can get the same effect. This one doesnt work with all ECU's though, some that i have attempted it with in the past the car would throw crank angle sensor faults and the car would stall after a few spark cuts because it got all confused or the processor crashed.

This is my goal in a project like this.
1. Figure out where certain values are in RAM.
-RPM
-What Ignition variables are available to be modified
-Clutch switch or any other switching input
-Wheel Speed. This can be used as for a roll out speed to deactivate the custom feature. set it to a low MPH like 2 so as soon as the wheels move its go time!
2. Find the end point where these timing values are placed into RAM after calculations from the maps and constants.
3. Create a jump out to custom code that works like this for testing.
-Code would compare to RPM constant in ram, if at or above 4000RPM place false value into RAM for spark cut.
-If below 4000 RPM follow to original code that was removed to make jump out to custom code.

What im surprised about is how long these GM ECU's have been worked with and reverse engineered and no one has created a solution like this yet. This would defeat the need for add on launch control boxes completely and most likely work better than any add on box out there because with add on boxes you dont have the ability to actually manipulate the actual ignition values which i feel is key to dialing in any launch control properly. Retard timing more to get more boost, less timing retard to get less boost. I have manupulated an 80's motronic to the point where if i pulled -35 degrees timing it would build 21-22psi on launch control which i a bit much boost as you only need 8-12psi to get out there but the point is overall control that can be refined far moret than an add on box. Well thats my start on this subject, if anyone thats interested in a project like this or is willing to help out with disassembly info to speed up the process that would be awesome!

Site Admin
User avatar
Posts: 5607
Joined: Sat Feb 28, 2009 8:34 pm

Re: developing a spark cut launch control solution

Postby antus » Wed Feb 20, 2019 3:13 pm

We did it on an earlier generation pcm here: viewtopic.php?f=27&t=3798
What that code does is reduce the dwell to the point where the spark fails. You definately wont be able to mess with cam signals, there is a cam learn procedure and I dont think you'd want to trigger the DTCs around that.
You can get some randoms OS bins you can reverse engineer in the bins thread here viewtopic.php?f=7&t=3
If your looking for a particular bin, just ask. Im sure we can make it appear.
pcmhammer works with any j2534 interface that supports VPW, or with the obddiag allpro usb, or scantool mx, or AVT 852/842.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 3139
Joined: Mon Aug 02, 2010 6:35 pm

Re: developing a spark cut launch control solution

Postby Dylan » Wed Feb 20, 2019 4:42 pm

I'll throw a couple of thing's that come to mind here. Likely they're totally irrelevant.

Do these ECU's have a different revision limit when I'm neutral in an automatical vehicle?

With the camshaft learn procedure I've seen on mail order performance tunes that they mask the DTC's for that and misfire codes as well.

Great sounding project and U agree. Given they're over 20 year's old in the USA it's surprising the general public is only starting to learn about them.

User avatar
Posts: 22
Joined: Fri Feb 28, 2014 7:38 am

Re: developing a spark cut launch control solution

Postby vwnut8392 » Thu Feb 21, 2019 10:00 am

antus wrote:We did it on an earlier generation pcm here: https://pcmhacking.net/forums/viewtopic.php?f=27&t=3798
What that code does is reduce the dwell to the point where the spark fails. You definately wont be able to mess with cam signals, there is a cam learn procedure and I dont think you'd want to trigger the DTCs around that.
You can get some randoms OS bins you can reverse engineer in the bins thread here https://pcmhacking.net/forums/viewtopic.php?f=7&t=3
If your looking for a particular bin, just ask. Im sure we can make it appear.
pcmhammer works with any j2534 interface that supports VPW, or with the obddiag allpro usb, or scantool mx, or AVT 852/842.


How you said about forcing dwell time to 0 is how its achived on the VW/audi motronic 7 ECU's so i understand exactly how that works. Older bosch motronics have no effect when you force dwell time like that so as in my example above we change ignition angle to a false value ATDC in RAM and it works beautifully. I would imagine if you did it in an older ECU for an LT1 perhaps than it shouldnt be hard to apply that same solution to the gen 3 ECU because these delco ECU's are like any other manufacturer the apple doesnt fall far from the tree. ECU is evolved to keep up with DOT emissions demands and electronics needs but the underlying principal of running the engine is the same. good point messing with cam/crank signals, i totally forgot about that relearn process so definitely not best to use that method. i will check out those bins and i looked at the allpro USB on their site and it seems there is no way to order it as far as i found. there's the DIY type board that i think is just serial for 25.00 on there but i would prefer to just cut to the chase and get a USB one already assembled. cant be that expensive.

so my next question is what processor is in these ECU's exactly so i can get it loaded into IDA pro? im going to guess there is a specific way to load RAM and ROM properly into ida pro.







Dylan wrote:I'll throw a couple of thing's that come to mind here. Likely they're totally irrelevant.

Do these ECU's have a different revision limit when I'm neutral in an automatical vehicle?

With the camshaft learn procedure I've seen on mail order performance tunes that they mask the DTC's for that and misfire codes as well.

Great sounding project and U agree. Given they're over 20 year's old in the USA it's surprising the general public is only starting to learn about them.


i think most people where content with HPtuners and the other pre-packaged tuning solutions for years but companies like HPT are focused on expanding their vehicle support instead of features for specifical vehicles and ECU's. The way i see it is the foreign car ECU scene is evolving way faster than the domestic car scene when it comes to custom coded features and add on's. Most foreign cars have in ECU launch control, flat shift, map switching, and have had it for many years now where as the domestic scene is dependent on add on boxes to get this stuff because thats how its always been here since the days of the carb. im still humored when i see an old drag car with 50 different controllers littered about the passenger compartment just to run the car, i've told the owners that standalone systems can control everything their doing in one easy box if they just run fuel injection with knock control and i get looked at like im an asshole lol. than they get pissed when their big budget race car gets wasted by short bed single cab C10 with a turbo LS in it that was built front junk and tuned on HPtuners with speed density lol. i just look and go "EFI FTW!" i call it evolution and its time for GM/delco to catch up.

User avatar
Posts: 161
Joined: Fri Feb 02, 2018 3:13 pm

Re: developing a spark cut launch control solution

Postby NSFW » Thu Feb 21, 2019 4:06 pm

The guy who makes the AllPro interfaces is on vacation. We're hoping he'll resuming shipping them when he gets back... we'll see.

As it happens, I just started disassembling a P59 OS in IDA Pro a couple days ago. I was just looking for a table of checksum ranges, and stopped after I found it, but it's a start.

https://github.com/LegacyNsfw/12592425

You might also want to look at this project, which is disassembling a 512kb / P01 operating system:

https://github.com/LegacyNsfw/12593358

That one has a powershell script that creates an IDC script that labels a bunch of functions in the bin file, based on a table of OBD2 PIDs and function pointers. That leads you to RAM variables for the things that correspond to the PIDs, which is really helpful.

There's also a powershell script that generates an IDC script that labels the tables in the calibration, which is also helpful. For that you need an XDF. The only P59 XDF I know of is here, at least for now: https://github.com/LegacyNsfw/PcmHacks/tree/develop/XDF At some point I'm hoping somebody centralizes all of the known XDFs in a new repository elsewhere, though.

It's also worth reading the wiki for the P01 project, and this thread: viewtopic.php?f=42&t=6240

If you find useful stuff, feel free to add to that thread. :)

Just FYI, as part of PCM Hammer, we're using the m68k version of GCC to compile code for the PCM. I think this means we can also use it to compile custom code to be stitched into the factory code... I haven't actually tried that yet in this context, but I used the SH4 version of GCC to compile code for my Subaru's ECU and that ended up working really well.
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

Site Admin
User avatar
Posts: 5607
Joined: Sat Feb 28, 2009 8:34 pm

Re: developing a spark cut launch control solution

Postby antus » Thu Feb 21, 2019 5:14 pm

Yep we sure can use it for custom code, its mostly the same process as compiling the flash kernels with a suitable link/load location and patching the output in to the bin by hand or with a small custom tool.

The processor is proprietry silicon but generally believed to be an m68332 and you can use that in ida with a load address of zero and a 16k ram segment at ff8000.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 32
Joined: Wed Apr 11, 2018 8:50 am

Re: developing a spark cut launch control solution

Postby bubba2533 » Fri Feb 22, 2019 12:44 am

antus wrote: [...] and a 16k ram segment at ff8000.


Is that true for both P01 and P59?

Site Admin
User avatar
Posts: 5607
Joined: Sat Feb 28, 2009 8:34 pm

Re: developing a spark cut launch control solution

Postby antus » Fri Feb 22, 2019 6:47 am

Yes
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

User avatar
Posts: 161
Joined: Fri Feb 02, 2018 3:13 pm

Re: developing a spark cut launch control solution

Postby NSFW » Fri Feb 22, 2019 4:04 pm

I tell IDA that there are two RAM segments:

00FF8000 - 00FFFFFF
FFFF8000 - FFFFFFFF

The decompiler seems uncertain about what the most significant byte it supposed to be. It finds references in both segments.
Also, while the physical RAM chip might only be 32k, there are registers mapped into the 32k above the actual RAM.
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

User avatar
Posts: 22
Joined: Fri Feb 28, 2014 7:38 am

Re: developing a spark cut launch control solution

Postby vwnut8392 » Sun Feb 24, 2019 5:46 am

all i have to say is WOW NSFW! looks like i have a lot of catching up to do! I built a bench flash harness today so i can test flash ECU's without a vehicle. i still have my hot soldering station to pull the flashes and manually reflash them if need be till i get a cable to use your software. looks like i'll have to venture out to my friends salvage yard and grab a few more GEN 3 ECU's for experimentation.

I sent you 2 PM's NSFW.

Next

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: No registered users and 1 guest