jenksta

Members
  • Content Count

    15
  • Joined

  • Last visited

  • Days Won

    4
  • Feedback

    N/A

Everything posted by jenksta

  1. If its just the error lamp/MIL you want to disable, set 0xF3AB (IAC open fault) & 0xF3AC (IAC close fault) to 0 in the upper & lower banks.
  2. The CEL is on to indicate current/adaptive knock (hence the ignition retard values on the right). The AFR/Boost values will only update if you have the sensors hooked up and configured correctly in TunerPro. Have a read through the wiki to find out how to do so.
  3. I've Added some notes on injector types and tidied up that page a little. As for the 'TPS for WOT detection', someone correct me if I'm wrong but that's simply the throttle position at which the ECU acknowledges you want full throttle and begins using the 'WOT enrichment' table/cells. As the general consensus is not to use this table then you shouldn't need to touch that for basic tuning.
  4. For anyone interested, I tune with adaptive knock on as it's my daily (full flashes no ostrich), so got sick of having to keep pulling battery/ecu to reset the adapative knock/fuel trims/etc when tweaking. Figured out if you set FLGINI (FLAG4.0 - initialization indicator) & clear the power fail counter (XCKPF0), it'll clear everything for next engine start and achieve the same as a full power down. I set this up to work with the pre start listener 'Clear all (0)' command so you can run it when needed (ign on - engine off) via TP or terminal, code is below (patch with hex editor or setup a patch in TP). patch @ 0x8985 02 8A AB 00 patch @ 0x8AAB 90 FD CB F0 90 FA F4 F0 D2 40 02 89 89
  5. What car is your m44 ecu from? If its from an non turbo you need to add two solder bridges inside the ecu or the TCV won't work.
  6. Yeah that one's from VIDA, there's also the list from MotronicSuite, however in regards to the MAF offset this isn't actually documented anywhere that I've seen, the stock 850 sensor doesn't put out 0-5v, I think max it puts out is 6.5 or so volts, and then the ECU sees this as 5v (ADC 255) due to whatever conditioning it has inside the ECU. I didn't do much testing myself but found that when switching to the HFM5 the actual voltage being output by the MAF and what the ECU was seeing was different (at idle it was down by 0.1v or so iirc) which I got around by using the different channel, then found Boxmans post on here since which I think he found it has an offset factor.
  7. For anybody interested, in my 850 I've used the HFM-5 MAF and 2.5bar TMAP sensor from an ME7 (T6 XC90 as I have 2 breakers...). Conversion factor for the MAP sensor is below (figure is in PSI with atmospheric pressure subtracted). ((270.59 * (X / 255)) / 6.895) - 14.7 As for the HFM-5 MAF, on the 850 MAF it has 2 grounds (pwr gnd+sig gnd), 12v and signal whereas on the HFM-5 it has 1 ground, 12v, signal and 5v ref (+NTC bulb on certain sensors). Due to this I had to run a 5v feed to it from the ECU (to save extra wire routing I cut the original MAF power ground from the ECU socket and used that as my 5v ref), also after alot of messing I figured out there is a voltage offset in the ECU for the original MAF (I later found Boxman mention this in this thread actually - here) so for a simple solution I swapped the MAF signal pin with the accelerometer signal pin and then changed the bin to use the accelerometer ADC chan for the MAF instead of the original MAF one. Voltage to flow table I extracted from the T6 bin and used as-is (minus the additional 256 values due to higher resolution in ME7) and seems to work fine so far. This MAF should flow to around 1250kg/h-ish so should be fine for my needs at the moment (TD04HL-20T).
  8. Been doing some comparison on the 607 vs 608 binary as regards to what differs (although I know most accept now to use 608 and simply toggle the KONFIG bit for auto/manual trans, however unfortunately I started my dissassembly with 607 so cba to start over with 608 haha). Majority of the changes are slight differences in ROM vars/maps (as expected) (pastebin link here for all but a few of the changed vars I've tracked - they're based on var names in my IDA DB which with the exception of a few follow the DAMOS naming). However code wise I can't really see anything significant but the biggest (or rather commonly occuring, 45x) is in the autos when setting SCL 0xE012 (injector number to be triggered I believe?) it loops until SCL 0xE010 != 0xFF before continuing, whereas on the manuals it doesn't care if SCL 0xE010 is 0xFF before carrying on its merry way... Anyone know the significance of this? (Perhaps unrelated to auto/manual and simply a code revision that added/removed this?).
  9. Thought this may be of use to someone, I created a 'checksum' plugin with the TunerPro SDK that duplicates the shared lower/upper bank data when the bin is saved. This means that instead of having two items in TunerPro for any of these duplicated data/tables/etc, you simply just set it up with the lower bank address and it'll automatically be duplicated to the UB (& re checksummed) once you save the file. As the TunerPro SDK isn't redistributable I can only share the bin, however it's nothing special and just copies 0xEF2C - 0xFC16 to 0x1EF2C 0x1FC16 (607 bin, haven't checked the addresses for the 608 bin but can do if anyone needs) then re-calculates the checksum bytes. You just need to set it up in the xdf the same way as the current checksum plugin. Also uploaded the latest version of my IDA DB which I've done a load more work on, particularly adding cross references for indirectly addressed memory (RAM, URAM (added another segment for this which wasn't there before, its the upper 128 bytes of the CPU ram that can only be indirectly addressed due to the SFRs using the same addresses for direct addressing) & XRAM) (was a wild ride coming to grips with the indirect addressing in the 8051 CPU haha) and also setup structures for alot of the map tables to document them easier based on their configuration from the DAMOS (table layout, leading bytes, different eeprom/non eeprom headers, map table addresses, e.t.c.). Both the above can be found here
  10. Just cheap ebay ones will do the job but it's hit and miss. Ideally one with the FDTI chip in it as people tend to have problems with the CH340 based ones, although mines CH340 and works fine.
  11. It's setup for these (https://www.injectorplanet.com/products/bosch-0280155766), they flow slightly more than the stock oranges (stock orange is 315cc, these flow 347cc). To set it up for oranges, in TunerPro copy the 3 values and 1 table under 'Injector Calibration' from the 18PSI bin as that's setup for oranges.
  12. R.E. the crank angle - correct me if i'm wrong but if it was me I'd work off of the ignition dwell time as that works in degrees of crankshaft rotation? Just had a quick look and there's some code around code1:BF9A (UB/1BF9A) to do with firing/dwell angle that might point in the right direction.
  13. I use 6.8, if you're using the latest free/trial version you may need to either source the 6.8 one or get your black hat on if you know what i mean.
  14. No worries, hopefully someone can make use of it someday haha. The XRAM vars I did do with a script, however everything else was done manually (sounds really tedious but I'm used to it so wasn't too bad). For the ROM variables I mostly just referenced vars I'd found in a function or something and go around that address double checking the byte patterns to ensure it was the same and nothing was added/removed in the different versions, then naming them (could have been scripted but just easier for me to carry on manually). When i started with the ROM vars I was putting descs in from the damos, but got tedious so in the end I decided to just name them, and have since managed to mostly figure out the DAMOS text file format, so will write a script to insert all the translated descriptions, data types and sizes from there then duplicate any to the upper bank if needed. The offsets in the code were admittedly all done manually by searching for hex offsets in the mov DPTR instruction , figuring out what its referencing (ROM, SCL, XRAM, e.t.c.) then using ALT+R (set base for offset) to set it as a ROM/RAM/XRAM/SCL offset (again probably could have been done with a script but meh haha), makes it so much easier to understand the code with them set though. One of the other things too was creating a seperate code segment for the upper bank so that any references in instructions point correctly to the upper bank and not the lower bank (also helps when IDA does the automatic disassembly as it can understand them properly so does alot more for you). Would have been relatively easy to do it on the blank file but chose to do it after I'd already done alot of work so the only way was to use IDC/Python to manipulate the segments slightly as otherwise it would destroy everything I'd already done. Bit late to the party as I know you guys have worked on this for years, but as only recently got an 850/4.4 and never touched 8051 stuff before I've learnt alot and also picked up some IDA tricks on the way, but worth it in the end
  15. Been lurking here for a while, but would like to say a big thanks to everyone who has contributed/helped with this as I wouldn't got so interested in it otherwise Just thought i'd share my IDA database that I've been working on for the past couple of weeks (pretty new to all of this) in case it can be of use to anyone (based on custom/wiki 607 rev 5b). It isn't the best but has the upper/lower bank disassembled/segmented and sorted (mostly) so that the disassembly makes sense (as well as sorting alot of the duplicated upper/lower bank funcs) (upper bank stuff mostly has _UB suffix). Also using the DAMOS and some other sources traced and labelled most of the ROM (v_ prefix) vars (mostly lower bank for now, will duplicate to upper bank later), RAM (r_ prefix), XRAM (xr_ prefix) and SCL (scl_ prefix) addresses. For the disassembly constants I linked them to the applicable CODE/ROM, XRAM or SCL segment for ease of disassembly/cross referencing (using virtual segments for XRAM and SCL offsets). The function naming is mostly vague and poor but can give a rough idea to some of the disassembly (although some may be incorrect based on earlier guesses before I started looking at the functions properly). As it's based on the custom/wiki rev 5b I've also labelled the custom functions/vars that are part of that too (mostly labelled with CUSTOM_ prefix). As I say alot of it has been compiled from multiple sources/references scoured from pretty much everywhere so lost track of who and what, but not claiming as mine - just couldn't keep track of everything. Download: https://drive.google.com/file/d/1cUPIOqOU0KckyA52apXzQq5ZVJ_LkT4s/view?usp=drivesdk