Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB

- Software Tuning (https://www.ft86club.com/forums/forumdisplay.php?f=88)

- - Open source Hybrid Speed Density (https://www.ft86club.com/forums/showthread.php?t=86521)

Quote:

Originally Posted by 1quickchic (Post 3186334)

@Yobiwan ,well here is a question, is it possible for me to make the changes to my ecu?a way to either import the settings or to write them into the rom, I also can use tactrix if its a better solution

Anything is possible but reverse engineering andwriting ecu code is not an easy task.

Wjile ztan has done the bulk of ghe work on the manual A01G rom which is what i believe @Yobiwan is using but simply calid changed to load into his oft, a calid change to a compatable rom is easy.

Unfortunatly from memory you were auto rom and manual and auto not compatable.

So you would need to port across ztans speed density subroutines over to the auto equlivant rom an A01I as this will be similar structure to A01G.

You would need to identify the same areas of the auto rom to patch in the speed density code. Then test to do this ztan used IDA a reverse engineering tool and then HEW to test code. Even then ztan bricked at least one ecu.

Could you upload the def for the SD hybrid. I tried to patch my def but it has no rpm or kpa values.

Quote:

Originally Posted by solidsnake11 (Post 3190523)

Could you upload the def for the SD hybrid. I tried to patch the my def but it has no rpm or kpa values.

try this one.

Is it possible to flash A01G to a C series. If not, does anybody have the hybrid speed density files for the C series ecu.

Quote:

Originally Posted by solidsnake11 (Post 3192468)

Is it possible to flash A01G to a C series. If not, does anybody have the hybrid speed density files for the C series ecu.

Yes, G is MT and so is C.

Quote:

Originally Posted by Yobiwan (Post 3183366)

Only rom that we can use SD on OFT platform is 6MT (2012-2017) by now.

Quote:

Originally Posted by solidsnake11 (Post 3192468)

Is it possible to flash A01G to a C series. If not, does anybody have the hybrid speed density files for the C series ecu.

Yes you can flash the A01G rom to any 86\brz\frs manual car from 2012-2016 ie pre facelift.

It will not work with facelift 2017 plus cars car wont start

I used ecuflash to flash A01G hybrid. Said yes to correct checksum in ecuflash then flashed. This also helped idle after a rev. Thank you guys for your time and help.

Hey guys. I'm using the ZA1JB01C SD mod but the definitions are gone. I was able to find some screen caps of the work I was doing to recover the 'Speed Density MAF' (d15a0)and 'Speed density Blend' (d14a0)tables on ECUFlash, but I'm missing the address for 'Speed Density Mode' table. I'm also unsure of the scalar that's supposed to be used here. Can anyone help me out? @ztan ?

*Edit* NM I was lucky enough to find the address for Speed Density Mode in an old email. (d1482) The table is supposed to be a switch but the speed density mode scalar works fine.

https://ibb.co/4dZ7pyv

Quote:

Originally Posted by D-VO (Post 3368071)

didztan specificly mod your B01C rom or its it jst a cald altered A01G if so the A01G SD def should work

Quote:

Originally Posted by steve99 (Post 3368252)

didztan specificly mod your B01C rom or its it jst a cald altered A01G if so the A01G SD def should work

I can't recall what exactly he did, but I can't get the A01G ROMs to start on mine; SD or non-SD so I gave up. *side note* A01C and B01C non-SD were fine but I couldn't get them to stop targeting 13.78 AFR on Idle and cruise even after zeroing out the AF3 tables. I ended up back with the B01C SD ZTAN made me. I'm guessing its running a rear O2 sim?

Anyway, the addresses for SD on the A01G don't work on B01C that was the first thing I tried, so maybe he didn't? I would love to look at the rest of the corrections made on Romraider since there are more tables defined there, but my B01C SD ROM won't open on it.

Ported ztan's speed density code to ZA1JK00G

Quote:

Originally Posted by ztan (Post 2208538)

Hybrid speed density implementation. This has worked for me; use at your own risk. Each SD table will need to be scaled individually for your own unique intake/FI/engine/AVCS/exhaust profile. I'm happy to share my work, but am not a software engineer, pro tuner, or automotive engineer.

My implementation works on the A01G ROM (not the OFT ones, as the ROM hole is used in the OFT ROMs with FFS/LC). Addresses I use are specific to this ROM - don't apply to yours if you don't know what you are doing.

I ported this to K00G, but I don't have a 'lab' vehicle to test it on right now, so I can't guarantee this works yet. Still, here's my porting notes and a patched K00G, romraider, logcfg; as well as the relevant ghidra dumps, where it differs from the original code at thread start. I chose K00G for the widest compatibility with modern tuning, but I could be persuaded if it's essential to do some specific other version as well.

Notes:

Quote:

In K00G, the MAF table pointer is located at 0BEA40 which is in turn listed in a cluster of pointers at 010628. This last list is referenced in the subroutine at 02B37E.

The replacement code at 2B37E will patch a jump to the new code at 0xCA110:

d2 02 42 4b a0 11 f9 0c 00 00 00 0c a1 10 00 00 00 00

There is one additional 5V sensor that wasn't present in A01G. I've verified that the MAF sensor is unchanged as the 8th sensor. (I wonder what the new sensor is?)

The end of the codebase can be reliably located by searching for a string of odd float constants; they'll be followed by a few more floats (if Ghidra shows code there, it's probably a lie), and then FFFF begins.

7f 80 00 01 00 00 00 00 7f 80 00 00 3f 80 00 00 3f 00 00 00 3e 80 00 00 40 00 00 00 40 80 00 00 40 49 0f dc 40 c9 0f db 3f c9 0f db 3f 49 0f db 3f 31 72 18 80 00 00 00 ff 80 00 00

However - in certain K00G ROMs, Launch Control is installed at the first empty block at 0BF570, so that space isn't available. Everything from BF5CC..FADFF is clear, though, so I'll use 0CA110 since it's unlikely any other K00G mods use that. (So, offset +10F60 for anyone reading the original code comments.)

FFF8D930 and below are in use, so the four RAM pointers are relocated from FFF8D400-040C to FFF8E100-FFF8E10C.

In K00G, three memory addresses changed: RPM: FFF89750; MAP: FFF8803C; IAT: FFF88040.

SD Blend is at CA1C0, SD Mode is at CA1A2.

The SD to MAF table is offset by +10F60 to CA1E0 (table), CA200 (float[24]), CA260 (float[23]), and the data at CA2C0 (word[24*23]).

New code and table start at CA110, ends at CA70F, and uses FFF8E100..E10C.

romraider:

Code:

<table name="Speed Density MAF" storageaddress="CA2C0" sizex="24" sizey="23">

      <table type="X Axis" storageaddress="CA200" />

      <table type="Y Axis" storageaddress="CA260" />

</table>

<table name="Speed Density Blend" storageaddress="CA1C0" />

<table name="Speed Density Mode" storageaddress="CA1A2" />

logcfg:

Code:

paramname = MAF_Sensor

paramid = 0xFFF8E100

isfloat = 1



paramname = MAF_SD_Raw

paramid = 0xFFF8E104

isfloat = 1



paramname = MAF_SD

paramid = 0xFFF8E108

isfloat = 1



paramname = MAF_Final

paramid = 0xFFF8E10C

isfloat = 1

Disassembly dump of the relevant sections:

Code:

XREF[1]:     0002b372 (j)   

        0002b37e d2  02           mov.l      @(->SD_patch_point ,pc),r2                       = 000ca110

        0002b380 42  4b           jsr/n      @R2=>SD_patch_point                              undefined SD_patch_point()

        0002b382 a0  11           bra        LAB_0002b3a8

        0002b384 f9  0c           _fmov      fr0 ,fr9

        0002b386 00  00           align      align(2)

                             PTR_SD_patch_point_0002b388                     XREF[1]:     0002b37e (R)   

        0002b388 00  0c  a1  10    addr       SD_patch_point

        0002b38c 00  00  00  00    align      align(4)





                             PTR_ENGINE_SD_MAF_sensor_000ca1a4               XREF[3]:     SD_patch_point:000ca128 (R) , 

                                                                                          SD_patch_point:000ca15a (R) , 

                                                                                          SD_patch_point:000ca198 (R)   

        000ca1a4 ff  f8  e1  00    addr       ENGINE_SD_MAF_sensor                             = ??

                             PTR_ENGINE_SD_table_000ca1a8                    XREF[1]:     SD_patch_point:000ca13c (R)   

        000ca1a8 ff  f8  e1  04    addr       ENGINE_SD_table                                  = ??

                             PTR_ENGINE_SD_final_000ca1ac                    XREF[1]:     SD_patch_point:000ca156 (R)   

        000ca1ac ff  f8  e1  08    addr       ENGINE_SD_final                                  = ??

                             PTR_ENGINE_SD_blend_000ca1b0                    XREF[1]:     SD_patch_point:000ca18c (R)   

        000ca1b0 ff  f8  e1  0c    addr       ENGINE_SD_blend                                  = ??

                             PTR_ENGINE_rpm_000ca1b4                         XREF[1]:     SD_patch_point:000ca12c (R)   

        000ca1b4 ff  f8  97  50    addr       ENGINE_rpm                                       = ??

                             PTR_ENGINE_map_000ca1b8                         XREF[1]:     SD_patch_point:000ca130 (R)   

        000ca1b8 ff  f8  80  3c    addr       ENGINE_map                                       = ??

                             PTR_ENGINE_iat_000ca1bc                         XREF[1]:     SD_patch_point:000ca140 (R)   

        000ca1bc ff  f8  80  40    addr       ENGINE_iat                                       = ??







                             PTR_SD_MAF_table_000ca1d0                       XREF[1]:     SD_patch_point:000ca138 (R)   

        000ca1d0 00  0c  a1  e0    addr       SD_MAF_table







                             SD_MAF_table                                    XREF[2]:     SD_patch_point:000ca138 (*) , 

                                                                                          000ca1d0 (*)   

        000ca1e0 00  18  00       3dmtable

                 17  00  0c 

                 a2  00  00 

           000ca1e0 00              db        0h                      xtype                             XREF[2]:     SD_patch_point:000ca138 (*) , 

                                                                                                                     000ca1d0 (*)   

           000ca1e1 18              db        24                      xsize

           000ca1e2 00              db        0h                      ytype

           000ca1e3 17              db        23                      ysize

           000ca1e4 00  0c  a2  00    float *   FLOAT_ARRAY_000ca200    xaxis

           000ca1e8 00  0c  a2  60    float *   FLOAT_ARRAY_000ca260    yaxis

           000ca1ec 00  0c  a2  c0    addr      WORD_ARRAY_000ca2c0     data

           000ca1f0 08  00  00  00    float     3.8518599E-34           xscale

           000ca1f4 3c  00  00  00    float     0.0078125               datascale

           000ca1f8 00  00  00  00    float     0.0                     dataoffset

        000ca1fc 00  00  00  00    align      align(4)

Quote:

Originally Posted by callisto (Post 3585519)

Code:

<table name="Speed Density MAF" storageaddress="CA2C0" sizex="24" sizey="23">

      <table type="X Axis" storageaddress="CA200" />

      <table type="Y Axis" storageaddress="CA260" />

</table>

<table name="Speed Density Blend" storageaddress="CA1C0" />

<table name="Speed Density Mode" storageaddress="CA1A2" />

logcfg:

Code:

paramname = MAF_Sensor

paramid = 0xFFF8E100

isfloat = 1



paramname = MAF_SD_Raw

paramid = 0xFFF8E104

isfloat = 1



paramname = MAF_SD

paramid = 0xFFF8E108

isfloat = 1



paramname = MAF_Final

paramid = 0xFFF8E10C

isfloat = 1

Disassembly dump of the relevant sections:

Code:

XREF[1]:     0002b372 (j)   

        0002b37e d2  02           mov.l      @(->SD_patch_point ,pc),r2                       = 000ca110

        0002b380 42  4b           jsr/n      @R2=>SD_patch_point                              undefined SD_patch_point()

        0002b382 a0  11           bra        LAB_0002b3a8

        0002b384 f9  0c           _fmov      fr0 ,fr9

        0002b386 00  00           align      align(2)

                             PTR_SD_patch_point_0002b388                     XREF[1]:     0002b37e (R)   

        0002b388 00  0c  a1  10    addr       SD_patch_point

        0002b38c 00  00  00  00    align      align(4)





                             PTR_ENGINE_SD_MAF_sensor_000ca1a4               XREF[3]:     SD_patch_point:000ca128 (R) , 

                                                                                          SD_patch_point:000ca15a (R) , 

                                                                                          SD_patch_point:000ca198 (R)   

        000ca1a4 ff  f8  e1  00    addr       ENGINE_SD_MAF_sensor                             = ??

                             PTR_ENGINE_SD_table_000ca1a8                    XREF[1]:     SD_patch_point:000ca13c (R)   

        000ca1a8 ff  f8  e1  04    addr       ENGINE_SD_table                                  = ??

                             PTR_ENGINE_SD_final_000ca1ac                    XREF[1]:     SD_patch_point:000ca156 (R)   

        000ca1ac ff  f8  e1  08    addr       ENGINE_SD_final                                  = ??

                             PTR_ENGINE_SD_blend_000ca1b0                    XREF[1]:     SD_patch_point:000ca18c (R)   

        000ca1b0 ff  f8  e1  0c    addr       ENGINE_SD_blend                                  = ??

                             PTR_ENGINE_rpm_000ca1b4                         XREF[1]:     SD_patch_point:000ca12c (R)   

        000ca1b4 ff  f8  97  50    addr       ENGINE_rpm                                       = ??

                             PTR_ENGINE_map_000ca1b8                         XREF[1]:     SD_patch_point:000ca130 (R)   

        000ca1b8 ff  f8  80  3c    addr       ENGINE_map                                       = ??

                             PTR_ENGINE_iat_000ca1bc                         XREF[1]:     SD_patch_point:000ca140 (R)   

        000ca1bc ff  f8  80  40    addr       ENGINE_iat                                       = ??







                             PTR_SD_MAF_table_000ca1d0                       XREF[1]:     SD_patch_point:000ca138 (R)   

        000ca1d0 00  0c  a1  e0    addr       SD_MAF_table







                             SD_MAF_table                                    XREF[2]:     SD_patch_point:000ca138 (*) , 

                                                                                          000ca1d0 (*)   

        000ca1e0 00  18  00       3dmtable

                 17  00  0c 

                 a2  00  00 

           000ca1e0 00              db        0h                      xtype                             XREF[2]:     SD_patch_point:000ca138 (*) , 

                                                                                                                     000ca1d0 (*)   

           000ca1e1 18              db        24                      xsize

           000ca1e2 00              db        0h                      ytype

           000ca1e3 17              db        23                      ysize

           000ca1e4 00  0c  a2  00    float *   FLOAT_ARRAY_000ca200    xaxis

           000ca1e8 00  0c  a2  60    float *   FLOAT_ARRAY_000ca260    yaxis

           000ca1ec 00  0c  a2  c0    addr      WORD_ARRAY_000ca2c0     data

           000ca1f0 08  00  00  00    float     3.8518599E-34           xscale

           000ca1f4 3c  00  00  00    float     0.0078125               datascale

           000ca1f8 00  00  00  00    float     0.0                     dataoffset

         000ca1fc 00  00  00  00    align      align(4)

Thanks
I have a bench flash setup and can test flash this to my bench ECU

Would you have the K00G definition for romraider with the added tables for the SD ?

I can probably work out the logcfg.txt but I'm not sure on the definition mods for K00G SD

Note the K00G rom will work in any manual 2017-2021 car any country

The only other SD rom needed would be K01I as it world do all auto cars 2017-2021

Only other addition needed would be an overboost cut I think ztan inmplemented that in his A01G code

Regard
Steve

Thanks steve

Quote:

Originally Posted by AussieBRZ (Post 3585604)

Only other addition needed would be an overboost cut I think ztan inmplemented that in his A01G code

I made overboost cut for A01E and K01E. Not hard for K00G if needed. I guess @callisto can do either.