developing a spark cut launch control solution

[vwnut8392]

Here's the IDB file that i got to work with ida 7.0 and NSFW's IDC script. It could be right, it could be wrong. The file is from an 03 silverado BIN i found floating around online that matched the ECU im using. Just open the IDB file with ida pro and it should work but if your using an older version than 7.0 it may not load it. if thats the case i will dig out my old laptop with 6.0 i think on it and do the same thing to generate an IDB for that version of IDA.

[MudDuck514]

Hi all,

vwnut8392, I tried using Ida Pro 6.5.
Just gives a fatal warning to use a newer version.

Mike

[vwnut8392]

I was ripping in to some 68k code last night and I also couldnt get it to create anything larger than 24 bit address space. I agree, use FF8000 but use 7FFF as the size. FFFFFF will overshoot the ram by huge margin (its not the end address).

i will have to dig out my other laptop with 6.0 on it, charge it up and do another IDB.

In the mean time here's some videos of my other cars and automotive projects using various factory bosch motronic ECU's with no add on boxes for spark cut launch control, flat shift and RPM limiters. just sharing some fun to keep motivated on the project.

This is my turbo 20V 5 cylinder audi S6 sedan using spark cut only launch control, flat shift and RPM limiter.
[youtube]https://www.youtube.com/watch?v=aybiw1BDUMw[/youtube]

This is my turbo 20V 5 cylinder S6 station wagon. this car has GT3582 and a pile of mods done
was told the that flat shift backfire and flame was insane so i had to see it for myself.
[youtube]https://www.youtube.com/watch?v=U-fYfZqebpQ[/youtube]

This is rail buggy with a mid engine VW 1.8T engine. makes a little over 300whp. this is on low boost at 12psi. just abusing it on the spark cut RPM limiter lol.
[youtube]https://www.youtube.com/watch?v=wUb9DQ0v1mA[/youtube]

[Gareth]

Love it, awesome videos

[vwnut8392]

its been a while but i started looking into this more. i did some other testing on a truck with no cats and high flow mufflers. The results are exactly what i was looking for. what i did here just to see what needed manipulated was set the dwell time table from 4000RPM onward to 0 and in the retard test i also set both high and low timing tables to -10 degrees retard at 4000RPM+.
[youtube]https://www.youtube.com/watch?v=BDIZaT5PAfQ[/youtube]

Now on to making the code for this actually functional. i have tried to use NSFW's script in IDA again to spit out a decent starting point for disassembly to find variables but i have not had any luck with it though this is what little information i have to offer without a decent disassembly of the code. The picture attached is of where i think the coil dwell table is accessed and the values from the table are placed into RAM. if im right this is an excellent place to make the jump out to custom code for launch control and flat shift, the jump could be made at S1:000379C2 to a JSR just like the next step below it. if the code is written correctly when the ECU gets to launch RPM it will force dwell time to 0 which makes RPM drop naturally and than the ECU will go back to reading the dwell table forcing the RPM to rise back to launch RPM and drop again giving the launch RPM limiter effect bouncing back and forth.

what i dont know where exactly in RAM the value from the table is placed. figuring out the RAM population is my current problem, i need to know where wheel speed, clutch pedal and engine RPM along with where the dwell time is placed to start, it will be another whole cam of worms to add the timing retard to it separately.

[vwnut8392]

Well i went ahead and tried using an auto disassembly tool for IDA pro that i got from the VW/audi chip tuning world. Awesome success with it as far as im concerned. anyhow here is an IDA 7.0 disassembly that i made with at tool. This one has a good proof of concept and very basic launch control code added into it. it may work and it may not, i dont know and i probably never will as i dont own anything to test on. How i labeled things in it was thanks to NSFW's IDC script which i just looked at in a text editor to get me in the ballpark where maps and constants where than followed the machine code around in IDA to figure out the source in RAM for those tables or constants. i dont know this code as well as i know 8051 machine code so what i chose in RAM may or may not be right.

This launch control code is very basic. its based off of roll out from the wheel speed sensor. if you are standing still launch control can become active, as soon as you move launch control shuts off. i can also add a spark cut RPM limiter on to this fairly easy than when combined with the stock fuel cut it will be a genuine 2 step RPM limiter. say you want 2 step active set fuel cut at 6500RPM and spark cut at 6800RPM or vise versa if you like that spark cut drama.

One thing i did notice is that when spark cut is active like in the video above the backfiring does trigger the knock control and more excessive timing retard happens plus the misfire counter. have to look into those 2 and see if a way to set a bit in RAM when launch control is active that will force the ECU to bypass those routines completely.

[bubba2533]

I would like to develop something like this for the 12587603 OS. I am currently using a N2MB WOT box to control my 2-step function. Rather than use the Vehicle speed I was hoping to use the brake pedal. My application may be a little different from most, but I am foot braking the car and it's an automatic so I don't want to have the 2-step active once I let go of the brake. It might be nice to have a vehicle speed threshold to enter the 2-step, but having the brake deactivate the 2-step I think would be faster. I would think that the clutch pedal switch could work the same way for manual vehicles, but it's likely at the top of the travel so not ideal. Also I was thinking it might be nice to have a TPS percentage to enable this function as well. That way you could rev the engine past the 2-step if wanted, but that may not be needed.

I have previously used a hack that used the Vehicle speed to retard timing (idle timing tables). I could tell there was a delay in the Vehicle speed causing the tables to switch. The other issue is sometimes I would notice that the vehicle speed would have noise from the 2-step which could cause some issues as well.

[vwnut8392]

I would like to develop something like this for the 12587603 OS. I am currently using a N2MB WOT box to control my 2-step function. Rather than use the Vehicle speed I was hoping to use the brake pedal. My application may be a little different from most, but I am foot braking the car and it's an automatic so I don't want to have the 2-step active once I let go of the brake. It might be nice to have a vehicle speed threshold to enter the 2-step, but having the brake deactivate the 2-step I think would be faster. I would think that the clutch pedal switch could work the same way for manual vehicles, but it's likely at the top of the travel so not ideal. Also I was thinking it might be nice to have a TPS percentage to enable this function as well. That way you could rev the engine past the 2-step if wanted, but that may not be needed.

I have previously used a hack that used the Vehicle speed to retard timing (idle timing tables). I could tell there was a delay in the Vehicle speed causing the tables to switch. The other issue is sometimes I would notice that the vehicle speed would have noise from the 2-step which could cause some issues as well.

thats all possible depending on if the variables are in the RAM. the delay you seen is probably because that code ran in a sub loop of the ECU and not a primary loop. all code i have done here is done in the primary loop so these are the most processor critical since i made the base code reside in a sub routine of the original code that drives the coils specifically. you could use the clutch switch input to control it regardless of what its attached to. if you put it on the brake pedal it would still work as long as you had the right switching logic in the actual switch. another way i have done it in german cars is to use an old aircooled beetle brake light switch which is hydraulic and mounts in a brake line but i put in line between the clutch master and slave. this gives a far better reaction. a brake switch would cause problems with the function turning on and off when bumping into the light at the track too. need to simply raise the wheel speed threshold a little higher so the launch control stays active when bumping in. TPS percent can be added but its not really necessary or if i would remove the wheel speed threshold and put it on a switch than you accidently bump the brake pedal on a full throttle pass the car activates launch control and junks the pass and potentially causes engine damage. a lot of variables to think about in this.


if i follow through with this it will probably work like this. if vehicle is not moving, clutch or brake is pressed and TPS is above 90% than launch control can activate. for flat shift function in a manual trans car it will be, if above 5800RPM and than clutch is pressed the flat shift can spark cut for X amount of time like 200ms. im sure a spark cut can happen in an auto during gear changes too since the ECU controls the trans too but its most likely not necessary and will server no real purpose.

[bubba2533]

Yeah exactly, you would condition the entry into the launch control so that it wouldn't be able to active above a set speed so accidental activation is prevented. And I would only use the speed to control the entry into the activation. Once it's active I think it would be best to control it going inactive would be either TPS or brake/clutch switch. Also adding an rpm hysteresis might be a good idea to tune how smoothly it can control rpm.

Flat foot shift would be a little more difficult I think. You'd have to add a timer or determine how quickly the PCM cycles through the logic to know how it correlates to time.

[vwnut8392]

Yeah exactly, you would condition the entry into the launch control so that it wouldn't be able to active above a set speed so accidental activation is prevented. And I would only use the speed to control the entry into the activation. Once it's active I think it would be best to control it going inactive would be either TPS or brake/clutch switch. Also adding an rpm hysteresis might be a good idea to tune how smoothly it can control rpm.

Flat foot shift would be a little more difficult I think. You'd have to add a timer or determine how quickly the PCM cycles through the logic to know how it correlates to time.

too much work to code it to turn on one way and than shut off another way. simple way is is just have multiple pre defined on/off variables that can be used depending on their settings like if you dont want wheel speed set it to 200mph than that will never activate. dont want the clutch switch just leave it unplugged or ground the wire from the ECU to the chassis and thats no longer active. i have written code for various volkswagen and audi ECU's for this exact subject and they all work with great success. the true trick here will be getting a good timing retard in there and providing the RPM window that it will activate before he actual spark cut activates. the spark cut alone works but with timing retard one can control the boost that is made far better. the spark cut is just to keep the launch RPM in check and the backfiring keeps the turbo spooled up. same with a correct working flat shift on a turbo car, yes when spark is cut it will unload the engine for X amount of time but the backfires keep the turbo spooled up during the gear change. my one audi goes 28psi flat, on gear change with flat shift boost goes 23psi and back to 28psi. never let that sucker unspool lol.