Tightmopedman9

Tuners Rejoice! Free Tuning For M4.4!

Recommended Posts

On 2/22/2020 at 4:22 PM, ItalianT5 said:

Hello,

I am having troubles flashing my ECU. I am using the following OBD cable: https://www.ebay.de/itm/Diagnostischen-FTDI-OBD2-FT232RL-BMW-INPA-Ediabas-USB-fur-DCAN-Kabelwerkzeug-H/303324951331?_trkparms=aid%3D111001%26algo%3DREC.SEED%26ao%3D1%26asc%3D20160727114228%26meid%3Db279ccc8bc4743859bd97ddc01231b2e%26pid%3D100290%26rk%3D2%26rkt%3D4%26sd%3D231461230279%26itm%3D303324951331%26pmt%3D0%26noa%3D1%26pg%3D2060778&_trksid=p2060778.c100290.m3507

I use 16.2 volts on B8 to go into bootmode, but all I get while trying to flash in Motronic Suite is "Erase failed". I also editet the config file and added my COM port, but nothing works.

Do I use the wrong OBD cable or are there any more possible problems I have to check first for?

Thanks in advance

Can't tell if that's the right cable or not.  I always look for some reference to Triumph motorcycles, like this:  https://www.ebay.com/itm/USB-cable-for-Triumph-Motorcycles-TuneECU-FTDI-FT232RL-Chip-OBD-II-KTM-Tune-ECU-/122549303447

But assuming you do have the right cable, you need to make sure you have hooked up all the ecu power and ground wires, and no loose connections.  Just hooking up one or two of them isn't going to do it.  Use similar gauge wire that's in the car too.

Share this post


Link to post
Share on other sites

That cable you linked is the incorrect cable. You need a VAG-COM cable, which is a 'dumb' cable which does nothing to the signal between the OBDII port and computer. 

Make sure that you get a VAG-COM cable with FTDI chip. 

Share this post


Link to post
Share on other sites

Hi

Can someone share settings for 100% E85 cold start, i have trouble to get engine running when engine and weather is cold, it need multiple short starts to get it running.

Share this post


Link to post
Share on other sites

Been lurking here for a while, but would like to say a big thanks to everyone who has contributed/helped with this as I wouldn't got so interested in it otherwise :)

Just thought i'd share my IDA database that I've been working on for the past couple of weeks (pretty new to all of this) in case it can be of use to anyone (based on custom/wiki 607 rev 5b).

It isn't the best but has the upper/lower bank disassembled/segmented and sorted (mostly) so that the disassembly makes sense (as well as sorting alot of the duplicated upper/lower bank funcs) (upper bank stuff mostly has _UB suffix).

Also using the DAMOS and some other sources traced and labelled most of the ROM (v_ prefix) vars (mostly lower bank for now, will duplicate to upper bank later), RAM (r_ prefix), XRAM (xr_ prefix) and SCL (scl_ prefix) addresses.

For the disassembly constants I linked them to the applicable CODE/ROM, XRAM or SCL segment for ease of disassembly/cross referencing (using virtual segments for XRAM and SCL offsets).

The function naming is mostly vague and poor but can give a rough idea to some of the disassembly (although some may be incorrect based on earlier guesses before I started looking at the functions properly).

As it's based on the custom/wiki rev 5b I've also labelled the custom functions/vars that are part of that too (mostly labelled with CUSTOM_ prefix).

As I say alot of it has been compiled from multiple sources/references scoured from pretty much everywhere so lost track of who and what, but not claiming as mine - just couldn't keep track of everything.

 

Download: https://drive.google.com/file/d/1cUPIOqOU0KckyA52apXzQq5ZVJ_LkT4s/view?usp=drivesdk

 

Edited by jenksta
  • Like 1
  • Upvote 1

Share this post


Link to post
Share on other sites

Thanks very much for that!

I've spent a lot of time in IDA and I  tried for a little while to import RAM variable names, but couldn't figure out an automated way to do it so I gave up on it. Did you write a script, or is there some easy way I'm totally missing?

 

Share this post


Link to post
Share on other sites
On 4/3/2020 at 4:33 PM, Tightmopedman9 said:

Thanks very much for that!

I've spent a lot of time in IDA and I  tried for a little while to import RAM variable names, but couldn't figure out an automated way to do it so I gave up on it. Did you write a script, or is there some easy way I'm totally missing?

 

No worries, hopefully someone can make use of it someday haha.

The XRAM vars I did do with a script, however everything else was done manually (sounds really tedious but I'm used to it so wasn't too bad). For the ROM variables I mostly just referenced vars I'd found in a function or something and go around that address double checking the byte patterns to ensure it was the same and nothing was added/removed in the different versions, then naming them (could have been scripted but just easier for me to carry on manually).

When i started with the ROM vars I was putting descs in from the damos, but got tedious so in the end I decided to just name them, and have since managed to mostly figure out the DAMOS text file format, so will write a script to insert all the translated descriptions, data types and sizes from there then duplicate any to the upper bank if needed.

The offsets in the code were admittedly all done manually by searching for hex offsets in the mov DPTR instruction , figuring out what its referencing (ROM, SCL, XRAM, e.t.c.) then using ALT+R (set base for offset) to set it as a ROM/RAM/XRAM/SCL offset (again probably could have been done with a script but meh haha), makes it so much easier to understand the code with them set though.

One of the other things too was creating a seperate code segment for the upper bank so that any references in instructions point correctly to the upper bank and not the lower bank (also helps when IDA does the automatic disassembly as it can understand them properly so does alot more for you). Would have been relatively easy to do it on the blank file but chose to do it after I'd already done alot of work so the only way was to use IDC/Python to manipulate the segments slightly as otherwise it would destroy everything I'd already done.

Bit late to the party as I know you guys have worked on this for years, but as only recently got an 850/4.4 and never touched 8051 stuff before I've learnt alot and also picked up some IDA tricks on the way, but worth it in the end :)

Share this post


Link to post
Share on other sites

I really appreciate the work, I've been working on a routine to log the cam angle, but haven't made much progress - this will really speed things up since cross referencing the DAMOS gets pretty tedious after only a few lookups. I'd like to monitor cam angle for VVT purposes.

 

NVM on the following stuff, P1.6 is the external clock output. 

I'm assuming that the cam signal is tied to P1.6. In Reset_0 the status of P1.6 is moved into r_FLAG1.7 (camshaft level with status 'found_located' (PH_OLD)).  In the crankshaft triggered interrupt, IEX3,there is a JB based on r_FLAGBM.4 (phase change not yet recognized. (ZDGVERB)), if this bit is set then the status of P1.6 is checked.

Since P1.6 is tied to IEX6 and IEX6 isn't used, I assume you could write a bit of code that moves the crank angle to a spare XRAM when IEX6 is triggered. Based on the sab80c517a  datasheet it looks like the interrupt would fire at the rising and falling edge, so you could poll the status of P1.6 and have a separate XRAM depending on which edge triggered the interrupt.  This would allow you to see the relative motion of the cam angle when triggering the VVT solenoids. 

I'm having trouble finding the variable that contains the crank angle in .75º degree increments, if it even exists. 

Edited by Tightmopedman9

Share this post


Link to post
Share on other sites

Aaargh, I can't open the file.  IDA says the database format is too old.

What version are you using to view it?

Share this post


Link to post
Share on other sites
24 minutes ago, bomb192uk said:

Aaargh, I can't open the file.  IDA says the database format is too old.

What version are you using to view it?

I use 6.8, if you're using the latest free/trial version you may need to either source the 6.8 one or get your black hat on if you know what i mean.

  • Upvote 3

Share this post


Link to post
Share on other sites
On 4/8/2020 at 6:56 PM, Tightmopedman9 said:

I really appreciate the work, I've been working on a routine to log the cam angle, but haven't made much progress - this will really speed things up since cross referencing the DAMOS gets pretty tedious after only a few lookups. I'd like to monitor cam angle for VVT purposes.

 

NVM on the following stuff, P1.6 is the external clock output. 

I'm assuming that the cam signal is tied to P1.6. In Reset_0 the status of P1.6 is moved into r_FLAG1.7 (camshaft level with status 'found_located' (PH_OLD)).  In the crankshaft triggered interrupt, IEX3,there is a JB based on r_FLAGBM.4 (phase change not yet recognized. (ZDGVERB)), if this bit is set then the status of P1.6 is checked.

Since P1.6 is tied to IEX6 and IEX6 isn't used, I assume you could write a bit of code that moves the crank angle to a spare XRAM when IEX6 is triggered. Based on the sab80c517a  datasheet it looks like the interrupt would fire at the rising and falling edge, so you could poll the status of P1.6 and have a separate XRAM depending on which edge triggered the interrupt.  This would allow you to see the relative motion of the cam angle when triggering the VVT solenoids. 

I'm having trouble finding the variable that contains the crank angle in .75º degree increments, if it even exists. 

R.E. the crank angle - correct me if i'm wrong but if it was me I'd work off of the ignition dwell time as that works in degrees of crankshaft rotation? Just had a quick look and there's some code around code1:BF9A (UB/1BF9A) to do with firing/dwell angle that might point in the right direction.

Share this post


Link to post
Share on other sites

Hey, got a question about the rev5b.bin, sorry in advance if im dropping this question in the wrong place, is the rev5b stock as in for orange injectors and a 15G/T? Im currently running a 608_rev5b flashed ECU calibrated for green injectors but am going back to orange to see if my MPG will improve. Just wondering if anyone has input on this because the bins 608_rev5b and 608_rev5b18PSI both have different injector calibration values from whats listed on the wiki. Don't know which to trust. I also have some red injectors from a v70, are those comparable to oranges? (not the insane 1Kcc reds lol)

My car, for reference: 94 850 turbo, manual swapped, m4.4, 15T, no cat, straight pipe with a autozone muffler.

Share this post


Link to post
Share on other sites
12 hours ago, SheaBae said:

Hey, got a question about the rev5b.bin, sorry in advance if im dropping this question in the wrong place, is the rev5b stock as in for orange injectors and a 15G/T? Im currently running a 608_rev5b flashed ECU calibrated for green injectors but am going back to orange to see if my MPG will improve. Just wondering if anyone has input on this because the bins 608_rev5b and 608_rev5b18PSI both have different injector calibration values from whats listed on the wiki. Don't know which to trust. I also have some red injectors from a v70, are those comparable to oranges? (not the insane 1Kcc reds lol)

My car, for reference: 94 850 turbo, manual swapped, m4.4, 15T, no cat, straight pipe with a autozone muffler.

It's setup for these (https://www.injectorplanet.com/products/bosch-0280155766), they flow slightly more than the stock oranges (stock orange is 315cc, these flow 347cc).

To set it up for oranges, in TunerPro copy the 3 values and 1 table under 'Injector Calibration' from the 18PSI bin as that's setup for oranges.

Share this post


Link to post
Share on other sites
On 4/15/2020 at 3:48 AM, SheaBae said:

Hey, got a question about the rev5b.bin, sorry in advance if im dropping this question in the wrong place, is the rev5b stock as in for orange injectors and a 15G/T? Im currently running a 608_rev5b flashed ECU calibrated for green injectors but am going back to orange to see if my MPG will improve. Just wondering if anyone has input on this because the bins 608_rev5b and 608_rev5b18PSI both have different injector calibration values from whats listed on the wiki. Don't know which to trust. I also have some red injectors from a v70, are those comparable to oranges? (not the insane 1Kcc reds lol)

My car, for reference: 94 850 turbo, manual swapped, m4.4, 15T, no cat, straight pipe with a autozone muffler.

I wouldn't bother going back to oranges.  Just tune the injector constant and the dead times to the greens.

Greens flow approx. 413cc at 3bar.  The injector constant for this should be 0.7656250.

Then you will have to tune the dead times but for this you'll need a wideband O2 sensor.  Some people have posted their dead times for greens on this thread, but they all differ for various reasons so be wary of using them.

More info on tuning injectors here https://m44.fandom.com/wiki/Tuning_the_Injector_constant_and_dead_times

Definitely get this sorted as the wrong fuelling can cause issues especially when the engine is under load

Edited by bomb192uk
  • Like 2

Share this post


Link to post
Share on other sites

According to the datasheets Greens should flow 453cc at 3 bar on N-Heptane but on petrol/gasoline they flow 413cc.

How were yours tested?

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.