Lean Cruise Tables
06-30-2008, 04:46 PM
#22
Tis interesting. I knew about the NG turbines going lean for emissions but also that causes problems with lean flame outs where the control system wants to reduce fuel and the RPM's go up. Basically --> the FLA blackout.
I dunno what they are doing. I have tried to idle my engine at the 20 to 22/1 range. Couldn't do it. Tried spark timing. Tried different ignition. Keep in mind I have the "turbulent" LM4 heads. Maybe I could try another ignition or different heads for a better placement of the plug. My car just couldn't idle that lean. It was horrible trying to step on the gas, too. No response. Now if you want to talk about 18.5/1. Sure, it would do it.
Or maybe the answer is with better fuel mixture. But solutions to those problems I just can't see happening on anything which remote resembles a stock vehicle....
I dunno what they are doing. I have tried to idle my engine at the 20 to 22/1 range. Couldn't do it. Tried spark timing. Tried different ignition. Keep in mind I have the "turbulent" LM4 heads. Maybe I could try another ignition or different heads for a better placement of the plug. My car just couldn't idle that lean. It was horrible trying to step on the gas, too. No response. Now if you want to talk about 18.5/1. Sure, it would do it.
Or maybe the answer is with better fuel mixture. But solutions to those problems I just can't see happening on anything which remote resembles a stock vehicle....
06-30-2008, 05:14 PM
#24
TECH Fanatic
iTrader: (25)
Join Date: Nov 2001
Location: SC
Posts: 1,784
Likes: 0
Received 0 Likes
on
0 Posts
For giggles, I had HPT open up the LeSabre V6 3800 II file for me to play around with, it does not show all the table like i was expecting so I had to play with the stoich AFR.
So far I have picked up 15% in MPGs in my daily commute to work, basically back roads.
I will begin to further mess with stoich to see what happens.
So far I have picked up 15% in MPGs in my daily commute to work, basically back roads.
I will begin to further mess with stoich to see what happens.
07-02-2008, 06:41 PM
#26
You should not be pulling timing to help gain MPGs, you either leave timing where it is or add some.
And the GTO tuning goes off of MAP and RPM or MPH, been a while since I have actually looked at it and it does have a time offset, which we usually pull down to like 1sec or something like that and then change the MAP range in which it comes in, and of course when you tip in the throttle it comes out of LEAN Cruise immediatly and you never know the difference.
This set up on an 04 GTO M6 19"TSWs with AI Heads with stock cam (for now) will get 30-32MPGs on the hwy.
We have done other tuning on the CTS-V and it gained 12% MPGs buy removing some TM, and changing the O2 mV for stoich.
Remember, the 14.7 is stoich for gasoline (100%) and the narrow bands tell us that should be .457ish on the O2 readings. You can tell the VCM what stoich reading should be either in the stoich box OR better yet, tell it what the mVs should be for stoich. Right now reducing the O2 box by about 100 in the appropriate areas.
And the GTO tuning goes off of MAP and RPM or MPH, been a while since I have actually looked at it and it does have a time offset, which we usually pull down to like 1sec or something like that and then change the MAP range in which it comes in, and of course when you tip in the throttle it comes out of LEAN Cruise immediatly and you never know the difference.
This set up on an 04 GTO M6 19"TSWs with AI Heads with stock cam (for now) will get 30-32MPGs on the hwy.
We have done other tuning on the CTS-V and it gained 12% MPGs buy removing some TM, and changing the O2 mV for stoich.
Remember, the 14.7 is stoich for gasoline (100%) and the narrow bands tell us that should be .457ish on the O2 readings. You can tell the VCM what stoich reading should be either in the stoich box OR better yet, tell it what the mVs should be for stoich. Right now reducing the O2 box by about 100 in the appropriate areas.
changing the switch points does not sound like a good way either unless you
really lower where pe comes in but that would kill mpgs. check out the tables in tuner cat. see the pdf you can set it up how the car is going to like it.
the tables are what i was going to start with not that they are right.
i'm shooting for 16.8-17ish :1 LC which would be knock \misfire on a switch point change
07-02-2008, 07:01 PM
#27
It wouldn't be in the tune. It would be in the OS itself. Now... you could go back to the EFI Live fourm page where it showed the sniplet of code right?
Translate those commands into Hex and then search for them in the OS... Then change it to a NOP.
If we had a way to know the IP [instruction pointer's] address and had all this BS on a bench we could step through and see what the IP points at in general operation. It would take a long time but we could do it.
Translate those commands into Hex and then search for them in the OS... Then change it to a NOP.
If we had a way to know the IP [instruction pointer's] address and had all this BS on a bench we could step through and see what the IP points at in general operation. It would take a long time but we could do it.
agreed, but how can you tell the differnce? it's all hex, reminds me of the movie the matrix when they were looking at code and seeing a picture of a beautiful woman. woooooosh!!!!! went over my head
what programing language do they use?
quote: Now... you could go back to the EFI Live fourm page where it showed the sniplet of code right?
i have not seen that it's not somewhere i have been. is it a sticky or a post ?
the more i find out the more i realize how little i know.
07-02-2008, 09:59 PM
#29
Sure, right now I am working on a lot of different projects. Hope this helps.
http://forum.efilive.com/showthread.php?t=833
Hex Editor is a good program but I know all the features aren't free. I know it can recalc a checksum.
DOWNLOAD
It wouldn't be an easy project but right now I have hex editor open. I have been changing the calibrations in my tune and comparing the files.
First I just changed the file name and compared. Then I just changed the VE and compared.... ect ect..
It isn't going to be cheesy easy but this is possible.
As for how do you translate the commands into hex you need a book for the particular processor. It may be downloadable on intel's site.
we would need to find out what processor it is i guess. that is possible too
Also i need to find out what qualifies as an ETC vehicle.... I don't know what he is talking about....
Default Lean Cruise, the real story
Like the old fill the tank with new fuel to reset the Octane scaler internet myth, there appears to be another one gaining popularity. That myth is that Lean Cruise actually functions on non Holden cars, both EFILive and HPTuners have explained that just setting the calibration variables like a Holden will not give Lean Cruise on a non Holden Platform.
For those that can read (or rewrite) assmebler code, here's the actual check in the PCM operating code to ensure Lean Cruise will not function unless the vehicle is a Holden.
EFILive does NOP encourage you to change this code :wink:
Cheers,
Ross
moveq #2,d1 ; #2 = Platform is Holden
cmp.b (byte_0_1E5C5).l,d1 ; Check against Platform type in cal
bne.s loc_0_29A96 ; If not the Holden then skip Lean Cruise
jsr sub_0_2F68E ; Jump to Lean Cruise Subroutine
loc_0_29A96:
jsr sub_0_38372 ; Jump to Knock control subroutine
Like the old fill the tank with new fuel to reset the Octane scaler internet myth, there appears to be another one gaining popularity. That myth is that Lean Cruise actually functions on non Holden cars, both EFILive and HPTuners have explained that just setting the calibration variables like a Holden will not give Lean Cruise on a non Holden Platform.
For those that can read (or rewrite) assmebler code, here's the actual check in the PCM operating code to ensure Lean Cruise will not function unless the vehicle is a Holden.
EFILive does NOP encourage you to change this code :wink:
Cheers,
Ross
moveq #2,d1 ; #2 = Platform is Holden
cmp.b (byte_0_1E5C5).l,d1 ; Check against Platform type in cal
bne.s loc_0_29A96 ; If not the Holden then skip Lean Cruise
jsr sub_0_2F68E ; Jump to Lean Cruise Subroutine
loc_0_29A96:
jsr sub_0_38372 ; Jump to Knock control subroutine
http://forum.efilive.com/showthread.php?t=833
Don't know, I started this stuff back in the Commodore 64 days!!
Unfortunatley the two people in the LS1 'scene', myself and Chris at HPT are maybe the only ones who know how to do this?.
The process.....
1 - Skip the Lean Cruise Platform check (different spot on all O.S's).
2 - Recalculate the checksum
3 - Fill Lean cruise table
NOTE: On ETC vehicles if you get the checksum wrong your PCM is toasted, chip off to recover it.
OR
Upgrade to any V3 O.S and use the MAP vs RPM AFR table to command leaner.
Cheers,
Ross
Unfortunatley the two people in the LS1 'scene', myself and Chris at HPT are maybe the only ones who know how to do this?.
The process.....
1 - Skip the Lean Cruise Platform check (different spot on all O.S's).
2 - Recalculate the checksum
3 - Fill Lean cruise table
NOTE: On ETC vehicles if you get the checksum wrong your PCM is toasted, chip off to recover it.
OR
Upgrade to any V3 O.S and use the MAP vs RPM AFR table to command leaner.
Cheers,
Ross
DOWNLOAD
It wouldn't be an easy project but right now I have hex editor open. I have been changing the calibrations in my tune and comparing the files.
First I just changed the file name and compared. Then I just changed the VE and compared.... ect ect..
It isn't going to be cheesy easy but this is possible.
As for how do you translate the commands into hex you need a book for the particular processor. It may be downloadable on intel's site.
we would need to find out what processor it is i guess. that is possible too
Also i need to find out what qualifies as an ETC vehicle.... I don't know what he is talking about....
07-02-2008, 10:15 PM
#30
I will add some more information.
OK. Let's say the processor was a TI 430 MSP. It isn't the processor in our car is an Intel. Or at least I think it is.
How would we translate our ASM code into the hex? We could look it up in the manuals and determine the output. Or we could download an Intel workbench. Punch in the code and then translate it into machine code for the processor in our car. Then search for that code in the bin dump of our car.
The fun part is going to be the checksum. Cause I dont know what part of the file to run the checksum on. I don't know what type of check sum to run... It will have ot be experimented with without frying pcms
OK. Let's say the processor was a TI 430 MSP. It isn't the processor in our car is an Intel. Or at least I think it is.
Originally Posted by TI 430 MSP instructions from [url
http://eleceng.dit.ie/frank/msp430/msp430.pdf][/url]
Simple programming examples
Addition of two constants.
Suppose we want our microcontroller/microprocessor to perform the following
action: Add the numbers 6 and 9 and store the result in memory location 200.
The assembler code to do this is shown below:
mov #6,R4 ; place the number 6 in register R4
add #9,R4 ; add 9 to it
mov R4,0200h ; store the result in 200h
Before this program can be run on the msp430 it must be converted to a
sequence of numeric instructions (machine code) using an assembler. Now
suppose that the assembler (for reasons we shall see later) places the machine
code in memory starting at address 110E. A memory image of this area is
shown below:
Address Contents (16 bit words)
110E 4034
1110 0006 These two words constitute "mov #6,R4"
1112 5034
1114 0009 add #9,R4
1116 4480
1118 F0E8 mov R4,0200h
Simple programming examples
Addition of two constants.
Suppose we want our microcontroller/microprocessor to perform the following
action: Add the numbers 6 and 9 and store the result in memory location 200.
The assembler code to do this is shown below:
mov #6,R4 ; place the number 6 in register R4
add #9,R4 ; add 9 to it
mov R4,0200h ; store the result in 200h
Before this program can be run on the msp430 it must be converted to a
sequence of numeric instructions (machine code) using an assembler. Now
suppose that the assembler (for reasons we shall see later) places the machine
code in memory starting at address 110E. A memory image of this area is
shown below:
Address Contents (16 bit words)
110E 4034
1110 0006 These two words constitute "mov #6,R4"
1112 5034
1114 0009 add #9,R4
1116 4480
1118 F0E8 mov R4,0200h
How would we translate our ASM code into the hex? We could look it up in the manuals and determine the output. Or we could download an Intel workbench. Punch in the code and then translate it into machine code for the processor in our car. Then search for that code in the bin dump of our car.
The fun part is going to be the checksum. Cause I dont know what part of the file to run the checksum on. I don't know what type of check sum to run... It will have ot be experimented with without frying pcms
07-02-2008, 11:01 PM
#31
On The Tree
iTrader: (8)
Join Date: Jun 2005
Location: Austin, TX
Posts: 145
Likes: 0
Received 0 Likes
on
0 Posts
I will add some more information.
OK. Let's say the processor was a TI 430 MSP. It isn't the processor in our car is an Intel. Or at least I think it is.
How would we translate our ASM code into the hex? We could look it up in the manuals and determine the output. Or we could download an Intel workbench. Punch in the code and then translate it into machine code for the processor in our car. Then search for that code in the bin dump of our car.
The fun part is going to be the checksum. Cause I dont know what part of the file to run the checksum on. I don't know what type of check sum to run... It will have ot be experimented with without frying pcms
OK. Let's say the processor was a TI 430 MSP. It isn't the processor in our car is an Intel. Or at least I think it is.
How would we translate our ASM code into the hex? We could look it up in the manuals and determine the output. Or we could download an Intel workbench. Punch in the code and then translate it into machine code for the processor in our car. Then search for that code in the bin dump of our car.
The fun part is going to be the checksum. Cause I dont know what part of the file to run the checksum on. I don't know what type of check sum to run... It will have ot be experimented with without frying pcms
Translating the code you have into hex won't do you any good either. The snippet of code from the EFILive forum is for a specific operating system. The byte which register D1 is being compared to is a specific location in the binary and almost certainly will not line up between various operating systems.
Additionally, since the file formats for each tuning program are not using actual binary dumps of the PCM, you don't know for certain if the files you are trying to modify have the actual dump of the operating system and segments or if it is compressed or encoded. If it is, you will definitely not have any luck searching for the hex corresponding to the assembly instructions you posted, nor will you have any luck if you used a disassembler.
No offense, but if you don't understand CPU32 assembler (or any assembly language), you will not succeed.
If you are hell-bent on enabling lean cruise, here is what I would do:
Identify how your tuning program is storing the actual binary that is flashed to the PCM in its save file (FWIW, EFILive imports the ZLib library, although I don't know if it's used with the save files). You will need to identify where the checksums and the operating system are stored within the save file, possibly involving some kind of decoding or decompressing of the segments.
Once you identify where the operating system is stored and where the checksum values are located, you will need to disassemble the operating system and find the lean cruise check subroutine. As I said earlier, you will probably not have the same OS from which the code snippet is from, so you will have to understand how the assembly works and figure out what you need to change.
At this point, you will change the check to allow for lean cruise to be enabled. Once you do this, you'll need to recalculate the checksum for the operating system (maybe CRC-16? it's probably simple). Once you have the new segment for the operating system and its checksum, you will have to encode/compress (if necessary) and insert it back into the save file.
07-02-2008, 11:52 PM
#32
Yea. It would be alot easier to get a raw bin of the PCMs flash. I did notice when I altered the tables the changed area of the file didn't respond how I figured it would.
You are right about how the segment of the OS which contains this code might not even be in the tuning file or if it is then it might be encoded. Which means the easiest thing to do would be to get the raw bin into a work bench and then step though the whole code.. OUCH.
Also I am currently confused on the checksum. If it keeps only segments of the OS how does the checksum fit it?? Isn't the check sum over the whole raw bin?
I know a lil bit of ASM, but I really know about FGPAs. This isn't my area. I am interested in trying though. Gives me yet another project to work on. All I do all day long is tech stuff.
I know people at GM@cal but not anyone who dev'ed the algorithms and did the matlab code leading up to this kind of stuff.
You are right about how the segment of the OS which contains this code might not even be in the tuning file or if it is then it might be encoded. Which means the easiest thing to do would be to get the raw bin into a work bench and then step though the whole code.. OUCH.
Also I am currently confused on the checksum. If it keeps only segments of the OS how does the checksum fit it?? Isn't the check sum over the whole raw bin?
I know a lil bit of ASM, but I really know about FGPAs. This isn't my area. I am interested in trying though. Gives me yet another project to work on. All I do all day long is tech stuff.
I know people at GM@cal but not anyone who dev'ed the algorithms and did the matlab code leading up to this kind of stuff.
07-03-2008, 01:49 AM
#33
On The Tree
iTrader: (8)
Join Date: Jun 2005
Location: Austin, TX
Posts: 145
Likes: 0
Received 0 Likes
on
0 Posts
The checksums (at least for the segmented, non-98 PCMs) are generated over each segment. You can see them when you initially open a tune file in EFILive (four hex digits).
If you have the ability to dump the raw binary, finding the routine would be substantially easier. I noticed EFILive imports ZLib (basic ZIP compression library); you may try to find information about the header that is required for ZLib and see if you can decompress the file. It may use something proprietary, but unless you are willing to do some more in-depth work to find out, it's an easier start. I can't imagine another purpose for importing ZLib other than storage, and all of the headers, notes, units, and settings are stored as text.
If you are really serious about getting this to work, shoot me a PM. I think we would have to invest a bit of work, but it might pay off (for you, I have a 98 PCM
). Besides, I think we may shortly venture into territory we can't discuss publicly.
If you have the ability to dump the raw binary, finding the routine would be substantially easier. I noticed EFILive imports ZLib (basic ZIP compression library); you may try to find information about the header that is required for ZLib and see if you can decompress the file. It may use something proprietary, but unless you are willing to do some more in-depth work to find out, it's an easier start. I can't imagine another purpose for importing ZLib other than storage, and all of the headers, notes, units, and settings are stored as text.
If you are really serious about getting this to work, shoot me a PM. I think we would have to invest a bit of work, but it might pay off (for you, I have a 98 PCM
). Besides, I think we may shortly venture into territory we can't discuss publicly. 
07-06-2008, 12:48 PM
#35
On The Tree
iTrader: (8)
Join Date: Jun 2005
Location: Austin, TX
Posts: 145
Likes: 0
Received 0 Likes
on
0 Posts
Some new information on this topic:
Apparently, as sreve has informed me, Tunercat is capable of saving files in an uncompressed bin format. This has allowed me to disassemble and compare a couple of the binaries from the 12212156 operating system.
The platform ID between the snippet on the EFILive forum and this file are stored at the same place (0x1E5C5). The US Camaro has an ID of 0, where as the Holden has one of 2.
In 12212156, the lean cruise check starts at 0x29AD2. It looks almost exactly the same as the EFILive forum snippet, but with some different addresses to branch/jump to.
To enable lean cruise, you have a few options: change the platform ID at 0x1E5C5 (or where ever it will be in the other operating systems, possibly the same location). This might not be a good idea, as apparently the platform ID is used for other things.
You could also change the "moveq #2,d1" to "moveq #x,d1" where 'x' is equal to your platform ID, or change the "BNE" to "NOP."
After changing the code, you will need to recalculate the checksum. From what I've found, the checksum for each segment is located at the beginning of the segment. To calculate it, you sum each of the words in the segment (excluding the checksum itself, with exception to the OS segment), logical AND that result with 0xFFFF, then XOR that result with 0xFFFF, then add one.
Alternatively, you can find where the checksum validation takes place and disable it.
Apparently, as sreve has informed me, Tunercat is capable of saving files in an uncompressed bin format. This has allowed me to disassemble and compare a couple of the binaries from the 12212156 operating system.
The platform ID between the snippet on the EFILive forum and this file are stored at the same place (0x1E5C5). The US Camaro has an ID of 0, where as the Holden has one of 2.
In 12212156, the lean cruise check starts at 0x29AD2. It looks almost exactly the same as the EFILive forum snippet, but with some different addresses to branch/jump to.
To enable lean cruise, you have a few options: change the platform ID at 0x1E5C5 (or where ever it will be in the other operating systems, possibly the same location). This might not be a good idea, as apparently the platform ID is used for other things.
You could also change the "moveq #2,d1" to "moveq #x,d1" where 'x' is equal to your platform ID, or change the "BNE" to "NOP."
After changing the code, you will need to recalculate the checksum. From what I've found, the checksum for each segment is located at the beginning of the segment. To calculate it, you sum each of the words in the segment (excluding the checksum itself, with exception to the OS segment), logical AND that result with 0xFFFF, then XOR that result with 0xFFFF, then add one.
Alternatively, you can find where the checksum validation takes place and disable it.
07-06-2008, 11:44 PM
#37
On The Tree
iTrader: (8)
Join Date: Jun 2005
Location: Austin, TX
Posts: 145
Likes: 0
Received 0 Likes
on
0 Posts
The segment definitions can be found at 0x50C. They are defined as long words with segment starts followed by segment ends (identifying the segments are easy as the end of one segment is one byte before the beginning of the next).
07-07-2008, 12:16 AM
#38
Teching In
Why would the disable lean cruise when it will increase MPG? Or is GM reducing their risk by letting us figure it out at our own risk and spying on the results.
07-07-2008, 11:26 AM
#40
Teching In