developing a spark cut launch control solution

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: developing a spark cut launch control solution

Post by antus »

in regard to the ram segments its not a physical 32 bit bus so they map to the same place. it might be better to define one and run an idc script to clean it up if its a problem, otherwise you end up with references to 2 places that should be the same. but whatever works for you.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
vwnut8392
Posts: 59
Joined: Fri Feb 28, 2014 7:38 am
cars: AAN powered 83 audi 4000 quattro
1983 audi UR quattro
1992 GTI VR6

Re: developing a spark cut launch control solution

Post by vwnut8392 »

i figured out a way roughly using HPT to see if NSFW's information about using coil dwell time to interrupt spark in the older ECU's and see if it falls true with the gen 3 ECU. Now this is a trick some was using in the VW world to achieve a 2 step rev limiter with spark cut activating first than fuel cut if the engine managed to get past the spark cut. This is how it was done and how i plan on testing it, i took the base coil dwell map and chose 4400rpm for my test so from 4400RPM up i made the map 0.00 or no dont charge the coils but injection should stay on. if the engine stops at 4400 as i hope it will drop down to the next lowest RPM column of 4000RPM and turn spark back on. in theory the engine should just bounce between 4400 spark off and 4000 spark keeping injection on giving that true spark cut effect. So if this work than we know we have to chase after the dwell time code and modify its value in RAM before it gets to the table so we would have added code for dwell time to 0 at X RPM than once the engine drop below X RPM it should follow normal logic again till it meets X RPM and shuts the coils down bouncing between the forced dwell time value of 0 and the actual dwell time from the table or tables/modifiers.

If first test works i will also use the timing table at roughly 4000RPM and have it retard timing as well and data log of this to see if it give the desired results. Once again if this falls true and it works than a point in code before the timing table will have to added to retard timing by like -25 degrees at 4000RPM. hope it works! i'll report back with my test results tomorrow evening unless someone else with HPT wants to give a go before i do and post the results.

Also this could be a cheater way to have a 2 step rev limiter on the stock ECU if damn HPT would let the user edit the RPM axis on the map because i think the 4000-4400 RPM window is going to be too big to be truly effective. They need to be closer to the tune of 4300 and 4400 so you get that fast on/off effect.
User avatar
vwnut8392
Posts: 59
Joined: Fri Feb 28, 2014 7:38 am
cars: AAN powered 83 audi 4000 quattro
1983 audi UR quattro
1992 GTI VR6

Re: developing a spark cut launch control solution

Post by vwnut8392 »

well i tested my idea and it works! i used the dwell map at a certain RPM and forced it to 0 with the exact end result i wanted. first video is with dwell time set to 0 and 4000 RPM. the second video i set high and low octane timing maps to retard to -25 degrees with dwell set to 0 at 4000 RPM as well. My tests where done on my 2005 express van that pretty much stock with just a reflash.


this video is just coil dwell time forced to 0 at 4000RPM. note the knock bar graph on the lower left. this tells me that the backfiring is there thats used to help a turbo spool up and keep spool to build boost. van still has a cat and stock mufflers so we wont hear the bangs but a the small "ping" sounds when it backfires.


This video i retarded the low and high octane maps at -25 degrees to test and see if it would retard timing properly. it didnt do exactly what i wanted it to do and its obvious that even -5 to -7 degrees is a bit much for the ECU/engine to get to spark cut.


So with this information could someone here help me setup ida or hook me up with an IDB thats already setup so i can start learning the assembly language to see if i can figure out a point where dwell time and actual ignition degree is placed into RAM.

For a basic setup all we would have to do is this......
find this stuff in RAM. RPM, dwell time, ignition angle and wheel speed.
set it up like this to be spark cut only for the first start. start in custom sub routine with if at or below 2mph go to spark cut, if not follow normal logic. If below and spark cut look at RPM and if engine is at or above 4000RPM force dwell time to 0, if not follow normal logic. thats about as simple as it gets and it will work like this, when sitting on the line not moving you can configure a proper launch RPM but as soon as the ECU registers wheel speed on the launch the feature shuts off and does cannot come back on till below 2mph. also if things like brake light switch for automatic or clutch switch for manual trans is a bit that gets set in RAM it could be made so that if brake or clutch is pressed, below 2mph, and at or above spark cut RPM force dwell to 0. with those in there if there is a wheel speed sensor failure it doesnt completely screw you with a rev limit via launch control RPM.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: developing a spark cut launch control solution

Post by antus »

vwnut8392 wrote: So with this information could someone here help me setup ida or hook me up with an IDB thats already setup so i can start learning the assembly language to see if i can figure out a point where dwell time and actual ignition degree is placed into RAM.
There is a good tutorial about 68k assembly language here: http://www.mrjester.hapisan.com/04_MC68/
Load the bin as motorola 68332 code to 00000, and create ram segments at FF8000 and FFFF8000 and clean one of those up later with idc if addresses end up resolving to both or just drop the unused part if they dont.
Use NSFWs idc to start commenting the code from a well defined xdf and go from there to identify ram addresses.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
vwnut8392
Posts: 59
Joined: Fri Feb 28, 2014 7:38 am
cars: AAN powered 83 audi 4000 quattro
1983 audi UR quattro
1992 GTI VR6

Re: developing a spark cut launch control solution

Post by vwnut8392 »

So with this information could someone here help me setup ida or hook me up with an IDB thats already setup so i can start learning the assembly language to see if i can figure out a point where dwell time and actual ignition degree is placed into RAM.

There is a good tutorial about 68k assembly language here: http://www.mrjester.hapisan.com/04_MC68/
Load the bin as motorola 68332 code to 00000, and create ram segments at FF8000 and FFFF8000 and clean one of those up later with idc if addresses end up resolving to both or just drop the unused part if they dont.
Use NSFWs idc to start commenting the code from a well defined xdf and go from there to identify ram addresses.

when i try to create the second RAM segment ida wont let me do it. pictures are attached how i was adding the second segment and the error i get.

adding the RAM2 segiment
adding the RAM2 segiment
segiment 1.JPG (31.56 KiB) Viewed 4931 times
Segment error
Segment error
segiment 2.JPG (19.29 KiB) Viewed 4931 times
Error i get when trying to run the IDC too.
Error when loading IDC.
Error when loading IDC.
error IDC.JPG (31.3 KiB) Viewed 4925 times
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: developing a spark cut launch control solution

Post by NSFW »

I've had bad luck creating RAM segments using that UI as well. I think it's a bug in IDA because those start and end addreses look perfectly valid to me.

I don't remember what I used in that dialog box, but I'm pretty sure I really created the segments using the segments tab in IDA. Or maybe skip that step and let the IDC file create the segments.

Try removing the call to the Tabs function in the IDC script. I'm not sure what it's for but I don't think it's useful. What really matters is the names and comments that the script creates later.

I'm guessing Tabs() was something that was supported in the version of IDA that I have (6.1) but not in the version you have. But like I said, it isn't important anyway.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
vwnut8392
Posts: 59
Joined: Fri Feb 28, 2014 7:38 am
cars: AAN powered 83 audi 4000 quattro
1983 audi UR quattro
1992 GTI VR6

Re: developing a spark cut launch control solution

Post by vwnut8392 »

NSFW wrote:I've had bad luck creating RAM segments using that UI as well. I think it's a bug in IDA because those start and end addreses look perfectly valid to me.

I don't remember what I used in that dialog box, but I'm pretty sure I really created the segments using the segments tab in IDA. Or maybe skip that step and let the IDC file create the segments.

Try removing the call to the Tabs function in the IDC script. I'm not sure what it's for but I don't think it's useful. What really matters is the names and comments that the script creates later.

I'm guessing Tabs() was something that was supported in the version of IDA that I have (6.1) but not in the version you have. But like I said, it isn't important anyway.
Im using ida 7.0. i will give that a shot and see where it goes for me, thanks for the help.
User avatar
Gampy
Posts: 2330
Joined: Sat Dec 15, 2018 7:38 am

Re: developing a spark cut launch control solution

Post by Gampy »

Right wrong or indifferent ... I dunno know.

This is how I get'er done in 6.8 ...

Select: File
Select: Open
Select: .BIN of your choice.
Select: Ok

At the: 'Load a new file' dialog.
LoadNewFile.png
LoadNewFile.png (10.45 KiB) Viewed 4900 times
Set: Processor Type: Motorola CPU32 (68330) [68330]
Select: Ok
Select: Yes


At the 'Disassembly memory organization' dialog.
DisassemblyMemoryOrganization.png
DisassemblyMemoryOrganization.png (8.58 KiB) Viewed 4900 times
Select: Create RAM section
Set: RAM start address: 0x00FF8000
Set: RAM size: 0x00FFFFFF
Select: Ok

That's all folks, yur in ... Now the cleanup starts, that's the hard part!
Starting with running the .idc script created with NSFW's excellent .xdf to .idc Powershell script.

Unfortunately, when it comes to math, I'm not sure what has the one up, a rock or I, so how to calculate and correct the split bus issue is beyond my math-less pee brain.

-Enjoy
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
User avatar
vwnut8392
Posts: 59
Joined: Fri Feb 28, 2014 7:38 am
cars: AAN powered 83 audi 4000 quattro
1983 audi UR quattro
1992 GTI VR6

Re: developing a spark cut launch control solution

Post by vwnut8392 »

Gampy wrote:Right wrong or indifferent ... I dunno know.

This is how I get'er done in 6.8 ...

Select: File
Select: Open
Select: .BIN of your choice.
Select: Ok

At the: 'Load a new file' dialog.
LoadNewFile.png
Set: Processor Type: Motorola CPU32 (68330) [68330]
Select: Ok
Select: Yes


At the 'Disassembly memory organization' dialog.
DisassemblyMemoryOrganization.png
Select: Create RAM section
Set: RAM start address: 0x00FF8000
Set: RAM size: 0x00FFFFFF
Select: Ok

That's all folks, yur in ... Now the cleanup starts, that's the hard part!
Starting with running the .idc script created with NSFW's excellent .xdf to .idc Powershell script.

Unfortunately, when it comes to math, I'm not sure what has the one up, a rock or I, so how to calculate and correct the split bus issue is beyond my math-less pee brain.

-Enjoy

Thanks for the help! i think i got it to work. i guess my goal is to figure out how how live data is pushed over OBD and that could lead to populating the RAM. I would imagine the data output blocks follow a certain order from a standardized OBD list so they could be in the same order in the code somewhere. With RAM populated it will answer a lot of questions.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: developing a spark cut launch control solution

Post by antus »

I was ripping in to some 68k code last night and I also couldnt get it to create anything larger than 24 bit address space. I agree, use FF8000 but use 7FFF as the size. FFFFFF will overshoot the ram by huge margin (its not the end address).
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Post Reply