• Hello Guest, welcome to the initial stages of our new platform!
    You can find some additional information about where we are in the process of migrating the board and setting up our new software here

    Thank you for being a part of our community!

Fuel/Spark tuning for LH 2.4/EZK with TunerPro!

ipdown said:
I'll explain how I found these constants.
I have built a "stimulator" for LH 2.4, which provides it
with all sensors input and rpm signal, and monitored the injector pulsewidth
on oscilloscope. Then, having the "source" assembly of 950 ECU I focused on
data section and code references to different values from there.
Feeding the ECU with constant rpm, load, etc. the above constants changed
the resulting pulsewitdth. Reg. bitsize of them, the #4 and #5 (as numbered
in InjConst utility) could be 16 bit value, while the others are most likely
alone bytes. They could statically scale temp., voltage or load for example,
thus changing the pulse width, but still at least one of them is the
real injector constant, since I literally tried every one suspicious
referenced byte in the data section and these are that affect the resulting pulsewidth.
There are another two which also changes injection frequency, but they are probably
dangerous to try on a running engine.
Click to expand...

I am so jealous of your hardware hacking abilities. Can we see a picture of the setup?

I'm going to download the ASM stuff today. These things that you have done are pretty damn impressive.
 
The first one is nothing fancy, basically proper power supply, some pots, and an ATtiny MCU for RPM signal. I don't have camera right now, but here are two older pics from the testbench:
 

Attachments

  • 950_test.jpg
    950_test.jpg
    105.3 KB · Views: 391
  • dlc 003.jpg
    dlc 003.jpg
    148.1 KB · Views: 387
ipdown said:
The first one is nothing fancy, basically proper power supply, some pots, and an ATtiny MCU for RPM signal. I don't have camera right now, but here are two older pics from the testbench:
Click to expand...

That's pretty sweet. I'm glad I'm not the only one using old PC PCUs as a bench supply :lol:

So, what exactly does the RPM signal look like? 0-5v square wave? 0-12v? I have a variable frequency generator and counter at home, so this would be really easy for me to setup. And worthwhile, considering...
 
Well, following ipdown's instructions, I downloaded, complied, and (sort of) successfully ran the 950 bin on my car!

The 950 bin is for a B204FT, so using a stock b230ft bin (937 I think), I copied the fuel table, various idle tables. warm-up tables, injector constants, and AMM linerization values (incl. the two changeover points) to the new bin... but it wouldn't run; it was super-rich to the point where it wouldn't start! After lowering the inj. constants, I had it running, but with lots of idle surging... running up to 2k rpm, then idle fuel cut, then back up... I couldn't seem to lean it out enough which makes me think either that there is something I missed, or something I don't understand...

But, compiling my own BIN from scratch and starting a vehicle with it gave me a huge nerd boner! :rofl:
 
Hehe, cool :cool:
What AMM are you running? Try the maps with your stock AMM map.

Btw, I am wondering what is the usual AFR of B230 during warmup enrichment if the temps is
in range of -5?C / 0?C?
 
ipdown said:
Hehe, cool :cool:
What AMM are you running? Try the maps with your stock AMM map.
Click to expand...

I did, I think. It was kind of late. I built the BIN (unmodified), then used tunerpro to copy/paste the tables, etc. that I wanted in.

I'm working on a source file with the correct tables already present, but I am moving very slowly because ASM is scary voodoo to me and I want to make sure it's right.

Idea: I was thinking about writing a "make" script that will build a source file from a collection of files containing the different maps... the perfect project for someone with lots of spare time.

Do you have any other disassembled BINs? Or steps on how to disassemble on my own? I have been trying for a while with varying levels success, and nothing that I'd be confident using in a running car! :-(
 
For just quick disassembly I am using Ida Pro v5.0.0.879
Settings used:
Open -> Binary/Raw File -> Processor Selection: Intel 51 series (8051) -> Device Name: C535

In order to produce the file I posted I used one old MS-DOS disassembler and a lot of hand editing after that.

Some time ago I started to program my own 8051 emulator, in order to run LH software in it, but not finished it. After some time, I decided to use the unfinished source to make an disasembler instead. The emulator decodes and emulates instructions (and hardware periperals), while disassembler just decodes and prints them out, so it was simpler. Here is the source, it have some small bugs with crossrefs (I don't remember what :lol:), but is decoding correctly and is useable and working. And is open source.
Here: http://linuxfan.org/~ipdown/mybrick/lh24/other/tools/dis515.zip

I used it to disassemble 208 and 156 EZK, and rkam's binary from his 6 cyl 960.

It is user assisted command line tool, intended to be used in multipass mode.
First you run it over an binary and looks the result. The valid code looks logical and meaningful, while data bytes decoded as instructions looks weird. So, on the next pass you
give to the tool the same binary file, and a switch specifiyng address range(s) to be excluded from disassembly. Then it just skips trying to convert data bytes to executable instructions and converts them to .DB (define byte) directives. You run many passes until you get bored and/or satisfied with the result. The output of my disassembler is directly syntax compatible with as31 assembler so it could be compiled back with it for verification.

For example if you disassemble 0xFF this will give you "MOV R7, A" opcode which is valid instruction. How to know which byte is data and which code? Obviously if you see a lot of "MOV R7, A" one after another they make no sense, and more likely should be just a bunch of: 0xFF, 0xFF, 0xFFs.

Btw, I am not sure if the version hosted on my site is latest. See here for more info..
 
Thanks!

My weekend just got much longer... And my brain hurts.

Thanks for being so open and straightforward with your methods and information, I'm sure that a lot of tbrickers would definitely buy you a beer, or case of beer, should you ever be in their hood... myself incuded! Спасибо! :cool:
 
Ok, so i'm disassembling the oh-so-popular 984 bin looking for data, and I notice that I keep finding single instances of MOV R7, A sandwiched into what appears to be legitimate code. I don't think it will, but will it bork as51 just leaving it like that?
 
beepee said:
Well, following ipdown's instructions, I downloaded, complied, and (sort of) successfully ran the 950 bin on my car!

The 950 bin is for a B204FT, so using a stock b230ft bin (937 I think), I copied the fuel table, various idle tables. warm-up tables, injector constants, and AMM linerization values (incl. the two changeover points) to the new bin... but it wouldn't run; it was super-rich to the point where it wouldn't start! After lowering the inj. constants, I had it running, but with lots of idle surging... running up to 2k rpm, then idle fuel cut, then back up... I couldn't seem to lean it out enough which makes me think either that there is something I missed, or something I don't understand...

But, compiling my own BIN from scratch and starting a vehicle with it gave me a huge nerd boner! :rofl:
Click to expand...

Was the plan to run this on a b230ft+16v? Seems like the right start for that.. which is something i'm hoping for.

Also, that's bad ass. I can't wait to have my car running off an emmulated EEPROM. :cool:
 
Update: nerd boner size++

Got the tubing to put my 012 AMM in today... got it installed.

My previous attempt at running the car on the 950 code with the 016 was not very successful; the best I got was a constant surging idle.

I redid the ASM file, and changed out the AMM maps for the 016, re-compiled, uploaded and after warming up it would idle happily all day! any sort of load made it unhappy though; it seemed to fuel cut and go super rich at about 2k rpm in the parking lot...

So, installed my 012 AMM, put the AMM tables back in for it (but left the B230FT fuel tables, warm up tables, injector contsants, etc. that I copied from the 937 bin), recompiled, and am sitting in it idling away right now.. just revving the engine in park, AFRs seem normal.. just a hair rich i think but mostly good. about to go for a test drive!

So basically, I've taken the software for a B204FT, and modified it for a B230FT. If this works it means that we (well, ipdown mostly :lol:) have found all of the major variables for LH2.4!

Will report back soon if I make it alive :)

my next dumb goal will be to make the thing ignore the checksum and reset the codes every time the car starts... :lol:
 
Last edited:
sorry if some asked this already I didnt read all ten pages. Im new so dont slam me all hard:lol:
What about Cars with Regina?? Can you do some thing with this ignition system?? My car is a 91 740 Volvo and It has a MAP SENSOR not a MAF, I run an AFC now to tune with but thats only fuel and I would like to do the ignition control to! do to the HP thats hidin in the timing. even the ecu to if the price is rite lmk if you can do some thing for me.
Thank you
 
740volvo said:
sorry if some asked this already I didnt read all ten pages. Im new so dont slam me all hard:lol:
What about Cars with Regina?? Can you do some thing with this ignition system?? My car is a 91 740 Volvo and It has a MAP SENSOR not a MAF, I run an AFC now to tune with but thats only fuel and I would like to do the ignition control to! do to the HP thats hidin in the timing. even the ecu to if the price is rite lmk if you can do some thing for me.
Thank you
Click to expand...

Nope. Totally different.
 
You must log in or register to reply here.
Back
Top