LS1 Ram log parameters

[kur4o]

Since supported Pids are not always best for tuning, which RAM addresses needs to be logged for best tuning of ls1.

I will try to find some sequence to find the needed RAM address, across all ls1 OS. But have no idea which needs to be logged.

Any suggestions are welcomed.

[Tazzi]

This is something I always thought about, but never thought of a simple way of identifying the ram address.

The only method I can think of, is if you simulate a sensor reading to the ECU, so its a perfect exact value, and then compare the PID value to RAM address values, until you find matches.
Change the value slightly and compare if the RAM value changes to match the PID value.

Its alot of work.. but.. is a potential method??

[Gampy]

Inquiring minds would like to know why supported pids are not always best for tuning ??

[turbo_v6]

Inquiring minds would like to know why supported pids are not always best for tuning ??

I would say one reason is that the SAE PID's are limited to certain ranges that could be exceeded (such as MAP being maxed out at 255 kpa).

[MudDuck514]

This is something I always thought about, but never thought of a simple way of identifying the ram address.

The only method I can think of, is if you simulate a sensor reading to the ECU, so its a perfect exact value, and then compare the PID value to RAM address values, until you find matches.
Change the value slightly and compare if the RAM value changes to match the PID value.

Its alot of work.. but.. is a potential method??

Hi all;

And THIS is why I grabbed the ENTIRE wiring harness WITH ALL SENSORS etc. when I pulled the LA1 3400 V6 replacement for my Venture!
Next up, a complete harness etc for a V8!

Mike

[Gampy]

I would say one reason is that the SAE PID's are limited to certain ranges that could be exceeded (such as MAP being maxed out at 255 kpa).

I thank you sir!

Learn something new everyday, I always thought PIDs were just standardized pointers to a raw value address ...

[NSFW]

Some of the PIDs are indeed exactly the same information you'd get from reading RAM.
Some of them have reduced precision (1 byte instead of 2) or use weird units (load as a percentage rather than as grams/cylinder).
And some of thing things you want for tuning don't have PIDs, like when I was tuning idle I wanted to see how the PID feedback values were contributing.

I'm pretty sure the only way to get RAM addresses is to reverse engineer the bin file, but it's not as hard as it might sound.

It's pretty straightforward to find a table in the ROM that maps from PID values to pointers to functions that fetch those PID values. Those functions tend to be really simple (they will always read a value from RAM, and maybe do some very simple arithmetic on it) so you can easily find the RAM addresses associated with each PID.

You can also start with table addresses from XDFs, and find the code that does the lookup (the disassembler make that easy). Right before the table lookup instruction, there will be instructions that read the RAM addresses associated with the table's inputs, and right after the table lookup there's usually code that stores the table's output value.

The more RAM addresses you find, the easier it is to figure out what other code is doing, because when you look at a random bit of code it'll have some of the addresses already defined, which makes it easier to figure out (or at least guess) what the remaining addresses are.

Anyway, when you find an address that seems interesting, you put it into the logger XML and see how it behaves. Sometimes it's what I thought, sometimes it isn't, so I usually take a couple/few guesses based on what I find in the disassembly. That raises the odds that one them will turn out to be right.

I was working on 3358 (because it was in my car) and lately I've been looking into 7603 (because that's what I'm switching to). 3358 is not something I'll spend more time on though - almost nobody else is using it or should be using it.

This stuff takes time, so I really think we should focus on 2156 and 6125 for P01s, and 7603 for P59s. Those will help the biggest number of users with the smallest amount of time.

[antus]

You can find ram addresses if you find a generic way of interpreting the code that handles the pid request in the DLC interrupt handler, but its true there isnt much extra there. Raw data eg 1 byte 0-255 is usually the analog ADC resolution. If you go say 3 bar map the analog resolution doesn't change, but the scaling to -100 to 300kpa does. if you read the map voltage pid you'll get the max precision which you can then scale on the pc side, same as the pcm does. dpids are about as good as you'll get. the packets get longer so fewer packets = less time lost in stopping and starting transmission but they dont get too long and you can get more data per packet more quickly. beyond that you can put the pcm in to 4x data speed and push a lot more data through again. None if this is to say you cant get more things if you go direct to ram but I dont think there is a huge amount of practical gain there.

[Gampy]

What's the difference between a pid and dpid ??

[NSFW]

PID = a single parameter
DPID = Dynamic Parameter, or something like that. For data logging you can configure a single DPID (id 0xFE - 0xFB) to return the values of 3-6 PIDs (6 bytes total).

The logger then asks for up to 4 DPIDs with a single request, and the PCM responds with up to 24 bytes of data.