Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB

- Software Tuning (https://www.ft86club.com/forums/forumdisplay.php?f=88)

- - Open Source Flex Fuel (https://www.ft86club.com/forums/showthread.php?t=94751)

Open Source Flex Fuel

***It works***

I filled up at a United station close next to work yesterday and they now have E85 supply there which they didn't have 6 months ago, and do not advertise it on their website.

Having implemented Hybrid Speed Density and Boost Limit Fuel Cut for my car, this is a logical next project which I'll develop openly and collaboratively until we have a solution or I lose interest or my car.

I do this for a hobby, so it need not be said, but ***TRY EVERYTHING AT YOUR OWN RISK*** My time is my own to waste on this project and I do not earn money as a tuner - having said this, I'm happy to take donations via PayPal at esltan@yahoo.com if you find any of the info that I've posted useful.

To do:
Source Hardware: tips at http://www.ecmtuning.com/wiki/ethanolsensorparts
Define Flex Fuel Sensor input method - Posts #3, #5, #11

Develop code to:
Hook the sensor routine - Post #14
Read and scale input to E% - Post #15
Scale PI and GDI separately or together based on E% - Post #31
Scale cranking PW based on E% - Post #32 (v.1), #46 (v.2), #49 (v.3)
Interpolate fuel and timing based on E% - Post #36 (fuel), Post #42(timing)
Apply scaling to display multiplier - Post #50

Extras:
Send E% data to PLX gauge - Post #11, #48
TRAC switch double click to turn off traction control or default to TRAC off - Post #30

email me if you want a copy of any of my files along the way.

Flex Fuel Hardware + Controller.

Starting reference: http://www.ecmtuning.com/wiki/ethanolsensorparts

The most commonly available Flex Fuel sensor around the market are the GM ones that send a 50Hz square wave out at E0 and 150Hz out at E100. 190Hz is output for water contamination.

We can buy a controller off the shelf to read the square wave frequency and convert it to a voltage signal that the ECU can read easily: available from any one of the vendors at the moment - saves a lot of time, but where's the fun in that? Alternates are to make our own frequency to voltage controller box or code the ECU to do the frequency analysis internally.

Sensor input connection to ECU

Having seen the E85 at the station yesterday, I went back home and pored over the wiring diagrams and the car.

The two commonly used sensor inputs are the rear oxygen sensor (O2S2) and the Evap pressure sensor. ECU pins as per diagram below (the wiring manual has the connectors as if you were looking end on at the harness plug - they are mirror-imaged when you look at them plugged in to the ECU.

I had a look at the connector AD2 (which is more accessible than the ECU) which joins the ECU to the fuel pump and Evap cannister harness: the wires were not there for the Evap cannister (A01G ROM). It turns out that I am in luck and the ECU does not interrogate Evap Pressure in my A01G car, so I don't need to compensate for losing the signal.

Moving on to connector A35 on the ECU, pin 20 was empty and I decided to hook a wire up to it. Pulled the connector out - it turns out that I could use the Molex pin from a scrap IDE type ribbon cable on this. To do this, lift the retainer on the IDE plug with a pick and pull the connector out. The A35 connector has a horizontal locking tab in the middle - that needs to be pulled out about 2mm, then the IDE Molex pin slides all the way down the barrel and does not come out when the locking tab is replaced. See last picture for new wire placement.

@ztan have you seen this thread opensource ethanol analyser

http://www.ft86club.com/forums/showthread.php?t=79865

Sensor input RAM address

A while ago, I had a look at the A01G disassembly to chase down a RAM value for MAF Voltage.

I had listed a whole bunch of potential RAM addresses from disassembling the sensor pull routines still available and did some logging with them all to trace the Evap pressure sensor ADC pin.

Logging all these for A01G:

Evap pressure sensor from 20(A35) voltage 16 bit value is stored at FFF842F8 and the float value sits at FFF87C7C after scaling.

Scaling:
Multiplier at 0011CC38: 137.62
Offset at 0011CC3C: 253.90

Without a connection to a sensor, the voltage is pulled up and logs ~5V (~940mmHg).

O2S2 from 21(A34) sends a 16 bit voltage value to FFF842FA.

I have not verified for other ROMs but the RAM addresses for the sensor pull bit of code tend to be uniform between calibration IDs that I've looked at.
If I'd known that the Evap pressure sensor line was unused in my car prior to installing my wideband, and knew I already had the RAM address sitting in a file to test, I'd have routed it there.

I wonder if its possible to hijack the ECU routine that sends the instantaneous L/100km to the dash display and send the ethanol content instead ?

This would be awesome!

ECU to measure frequency

I've been looking at the ECU datasheet to see if there is a way to use the counter in the ECU to directly measure pulse width off a square wave using the advanced timer unit (ATU III).

Unfortunately, the Evap line 20(A35) connects to the A/D converter at AN_B43 and I can't see that it has a trigger for the ATU directly.

Does anyone know of which pins in the ECU connectors are available to trigger the timer, or does anyone have a disused ECU to post to Australia which I can disassemble to try to trace one? Even a bricked one ok as I just need to trace connector pins to the chip.

So I bricked my ECU testing a routine that would read frequency over the ADC line. Didn't check my programming work thoroughly by running each step through HEW as I have in the past. Part of the routine made a bad call and sent my ECU into a loop as soon as the sensor scan routine is run (almost immediately).

Lesson learned with a new idea - it would be easy enough when testing any new routine to switch into it via defogger switch: if it hangs, the ECU will still communicate for a re-flash with defogger switch off.

Have a new ECU in from dealer recoded to my keys. Will resume this project when a suitable unbrick solution available - I'll start that thread.

Wow. Sorry to hear that. I would offer help, but am light years behind you on messing with the ecu.

Having gotten my bricked ECU to talk on the bench again (but not 100% functional) using SHBoot, time to get back up developing.

The Evap sensor routine that I hooked polls the sensor at 60-80ms intervals - too slow to use to read frequency properly in the 50-150Hz range that the GM FlexFuel sensor uses - will convert to 0-5V output to make this work easier on the Evap A35-20 input.

Having a PLX DM6 gauge for wideband display, I decided to use an Arduino Nano ($3 on eBay) to do the following:

1. Read Hz signal from FlexFuel sensor

2. Output 0-5V signal to ECU. The Evap pin is pulled up to 5V without anything attached, so I have initially coded E0 to send 5V and E100 to send 0V

3. Output serial PLX iMFD packet to PLX daisy chain (using Fuel Level sender ID code as I could not find any device ID for a Flex Fuel sensor for the DM6). This needs to be the terminal device in the PLX chain and will display E% as "Fuel Level" on the gauge.

4. Flex fuel sensor can be calibrated using pure gasoline and E85 inputting the frequency reads into the E0 and E85 values in the code before sending to Arduino. The Continental 13577429 sensor that I have reads 55 Hz with gasoline and 131 Hz with E85. I also have a couple of Chinese made 13577379 eBay sensors which have linear output but calibrations are off (80 Hz with gasoline, 150Hz with E85) if anyone wants a cheap working sensor with calibration data, PM me.

Frequency read is based on FreqMeasure library at PJRC

Arduino code and Nano circuit diagram (it all works):

Code:

//Flex Fuel sensor code

//Input frequency on pin 8 - pulled up to 5V through 1.8K resistor

//V_out pin 3 - 0-5V output through 1.8K resistor with 10uf capacitor to ground

//PLX iMFD serial packet on Tx pin 0 through 3.3V TTL voltage divider (3.3K/6.8K)



#include <Arduino.h>

#include <FreqMeasure.h>



double sum = 0;

int count = 0;

int ethanol_int, V_out_int;

float freq, ethanol, V_out, E_scalar;

float E0 = 50; //calibration data for pure gasoline

float E85 = 135; //calibration data for E85

long P0, P1, Pdelta;

byte PLXpacket[7] {0x80, 0x00, 0x11, 0x00, 0x00, 0x00, 0x40};



//PLX iMFD packet, sent every 100ms:

//0x80      Start byte

//0x00 0x11 Sensor device fuel level

//0x00      Sensor instance

//0x00 0x00 Sensor value (integer, unscaled)

//0x40      Stop byte



void setup()

{

  pinMode (3, OUTPUT);

  FreqMeasure.begin();

  Serial.begin(19200);

  P0 = millis();

  E_scalar = (E85 - E0) / 85;

}



void loop()

{

  if (FreqMeasure.available())

  {

    // average several readings together

    sum = sum + FreqMeasure.read();

    count = count + 1;

    if (count > 30)

    {

      freq = FreqMeasure.countToFrequency(sum / count);

      sum = 0;

      count = 0;

    }

  }



  ethanol = (freq - E0) / E_scalar; //scale frequency to E% interpolating E0 and E85 values

  if (ethanol > 100)

  {

    ethanol = 100;

  }

  if (ethanol < 0)

  {

    ethanol = 0;

  }

  ethanol_int = (int)ethanol;



  V_out = 5 - (0.05 * ethanol);

  V_out = 51 * V_out; //scale to 255

  V_out_int = (int)V_out; //convert to integer for analogWrite



  analogWrite(3, V_out_int); //output V_out as PWM voltage on pin 3



  P1 = millis(); //send PLX packet on Tx pin every 100ms

  Pdelta = P1 - P0;

  if (Pdelta >= 100)

  {

    P0 = P1;

    PLXpacket[5] = ethanol_int; //set data byte in PLX packet to E%

    Serial.write(PLXpacket, 7);

  }

}

Awesome Work! Glad to hear you got the ECU up and (sorta) running. Excited for the results.

Keep up the good work Ztan have been watching your work for a while now . p.s thanks for the help you gave Shiv with my tune.

Hooking new code into existing routines.

This is an example of how to hook code into an existing routine. Not 100% elegant, but there is plenty of free space to work with in our ECUs so I haven't optimized it for space.

Be careful when using the delayed slot instructions (jsr, rts, bra...) if you have any delayed instructions that reference addresses, the results can be quite screwy. The 32 bit instructions instructions in a delayed slot also are not reliable. Use of jsr/n, rts/n makes code more reliable, even though it takes up an extra clock cycle.

Example:

In the A01G ROM, the routine at 2B0E8 in the stock ROM scales sensor voltage data in fr4 according to multiplier and offset (Throttle angle, Accelerator angle, Batt Voltage, MAP sensor, Evap Pressure sensor)
Evap pressure sensor data is read when r6 = 06 and r13 = 0B.
At the end of this block of code, the program then branches to 2B100 with the scaled value stored in fr9.

Code:

ROM:0002B0E8             loc_2B0E8:                              ; CODE XREF: Scale_16_bit_sensor_data_in_table

ROM:0002B0E8 46 08                       shll2   r6              ; Shift Logical Left 2

ROM:0002B0EA 46 00                       shll    r6              ; Shift Logical Left

ROM:0002B0EC D2 21                       mov.l   #off_10E0C, r2  ; Move Immediate Long Data

ROM:0002B0EE 60 63                       mov     r6, r0          ; Move Data

ROM:0002B0F0 06 2E                       mov.l   @(r0,r2), r6    ; Move Long Data

ROM:0002B0F2 F0 68                       fmov.s  @r6, fr0        ; Floating-point move single precision: Multiplier value

ROM:0002B0F4 72 04                       add     #4, r2          ; Add binary

ROM:0002B0F6 06 2E                       mov.l   @(r0,r2), r6    ; Move Long Data

ROM:0002B0F8 F9 68                       fmov.s  @r6, fr9        ; Floating-point move single precision: Offset value

ROM:0002B0FA A0 01                       bra     loc_2B100       ; Branch

ROM:0002B0FC F9 4E                       fmac    fr0, fr4, fr9   ; Floating-point multiply and accumulate: fr9 = fr0(multiplier)*fr4(sensor voltage)+fr9(offset)

This substitute code loads a ROM address for a new subroutine in a patch of empty ROM in place of the old sensor scaling, returning with a sensor value in fr9 before branching to 2B100:

Code:

ROM:0002B0E8             loc_2B0E8:                              ; CODE XREF: sub_2B0A2

ROM:0002B0E8 D2 03                       mov.l   #sub_B97C0, r2  ; Move Immediate Long Data

ROM:0002B0EA 42 4B                       jsr/n   @R2 ; sub_B97C0 ; Jump to Subroutine with No delay slot

ROM:0002B0EC A0 08                       bra     loc_2B100       ; Branch

ROM:0002B0EE 00 09                       nop                     ; No Operation

ROM:0002B0EE             ; ---------------------------------------------------------------------------

ROM:0002B0F0 FF FF FF FF+                .datab.l 2, h'FFFFFFFF

ROM:0002B0F8 00 0B 97 C0 off_2B0F8:      .data.l sub_B97C0       ; DATA XREF: sub_2B0A2:loc_2B0E8

ROM:0002B0FC FF FF                       .datab.b 2, h'FF

The new subroutine at B97C0 replicates the original routine, checks if the Evap sensor is being evaluated; returns immediately if not, and runs on to new code otherwise before returning.

Code:

ROM:000B97C0             sub_B97C0:                              ; CODE XREF: sub_2B0A2

ROM:000B97C0                                                     ; DATA XREF: sub_2B0A2:loc_2B0E8

ROM:000B97C0 4F 22                       sts.l   pr, @-r15       ; Store System Register Long

ROM:000B97C2 46 08                       shll2   r6              ; Shift Logical Left 2

ROM:000B97C4 46 00                       shll    r6              ; Shift Logical Left

ROM:000B97C6 02 10 0E 0C                 movi20  #off_10E0C, r2  ; 20-bit immediate data transfer

ROM:000B97CA 60 63                       mov     r6, r0          ; Move Data

ROM:000B97CC 06 2E                       mov.l   @(r0,r2), r6    ; Move Long Data

ROM:000B97CE F0 68                       fmov.s  @r6, fr0        ; Floating-point move single precision: Multiplier value

ROM:000B97D0 72 04                       add     #4, r2          ; Add binary

ROM:000B97D2 06 2E                       mov.l   @(r0,r2), r6    ; Move Long Data

ROM:000B97D4 F9 68                       fmov.s  @r6, fr9        ; Floating-point move single precision: Offset value

ROM:000B97D6 F9 4E                       fmac    fr0, fr4, fr9   ; Floating-point multiply and accumulate: fr9 = fr0(multiplier)*fr4(sensor voltage)+fr9(offset)

ROM:000B97D8 60 D3                       mov     r13, r0         ; Move Data

ROM:000B97DA 88 0B                       cmp/eq  #h'B, r0        ; Compare: Equal: if sensor value being returned is Evap (r13 = 0B), the T bit is set

ROM:000B97DC 8B 2F                       bf      loc_B983E       ; Branch if False:  Branch to return to stack after restoring pr



ROM:000B97DE Write new routines in here... then return to stack after restoring pr (at B983E in this case)



............



ROM:000B983E             loc_B983E:                              ; CODE XREF: sub_B97C0

ROM:000B983E 4F 26                       lds.l   @r15+, pr       ; Load to System Register Long

ROM:000B9840 00 6B                       rts/n                   ; Return from Subroutine with No delay slot