CSL '0401' Program Binary Disassembly Notes

[karter16]

I'm probably going to do a bad job of explaining this as it has a bunch of components to it, but I've figured out the operating system (by the way the name of the OS is OSKAR) task scheduling system. When I have a high enough level of enthusiasm I'll document this properly in the wiki, but for now here's the quick run-down.

Each processor in the DME receives an external timer interrupt from the programmable interrupt timer 1024 times per second (e.g. approximately every millisecond).

The interrupt is handled here:



So this function fires every 1ms, and in it it does some important high frequency things like update the system timertics variables, sync the values in the dual-ported RAM to local copies of the variables, etc.

Every 2ms it calls sys_process_scheduled_tasks() which checks all scheduled tasks, updates the delay timers on each task and reschedules periodic tasks.

Every time the function runs, and provided there are no other active interrupts, the tasks are actually dispatched via sys_dispatch_tasks which in turn calls sys_task_dispatcher.

Both of these functions are below:





There is also a function to schedule a task in the first place:




And to cancel tasks:


The details of the tasks are stored in a pointer array in the program ROM (0x0003d810 in Master) which in turn points to a table of structs



The array of structs starts at 0x0003d798 (in Master program ROM)



And this is what I've figured out of the structure so far:



It's important to note that sys_process_scheduled_tasks runs every 2ms (every other time the timer interrupt fires) so the period and the initial delay of each task is specified in units of 2ms. e.g. task_10ms has period_2s set to 0x0005:



The task manager can manage up to 32 different tasks and can schedule up to 8 of them at once for execution.

[MC346]

Okay so this is very limited.

Essentially what it does is monitor for the condition where the car is in 4th gear and has been cruising between 44 and 54 km/h for more than 3 seconds. At that point it enters "noise" mode where the max requestable torque is limited. As soon a different gear is selected or the car drops below 44 km/h or goes about 70 km/h noise mode ends.

It's worth noting that in the 1801 binary the parameters are different (3rd gear instead of 4th, and speed thresholds differ) so this has been tuned specifically for the CSL binary.

So it's super restricted. I have no idea what scenario it's trying to mitigate. If someone wants to give it a go and report back on whether they can detect any difference that would be super cool.

This smells like drive-by noise testing..

[Bry5on]

So would that then mean that the reason why that one region of the table is slightly higher in the CSL tune is that the difference in cams allows for a slightly longer intake period which allows for slightly more mixing time?

Either cams or something to do with less restriction in the CSL airbox vs MAF, or both.

[karter16]

karter16
What are ARBID's?
i guess they are ARB ID's but what are they for?

Arbitration ID - used as part of the CAN communication format to deal with situations where multiple messages are flying around the bus at the same time. The message with the lowest ARBID value wins. Part of the plan for introducing another CAN message is to give it a suitably high ARBID so that everything else wins. That way the more critical CAN functions continue on unimpeded and the new message can be transmitted when the bus is free.

[karter16]

Just a few percent higher seems to cause instability. I believe you want the air velocity high enough for effective fuel mixing, so if you open the throttles too much you pass a sad point of no return. They really seem to have pushed it pretty close to the max as far as I could tell when playing with that variable.

So would that then mean that the reason why that one region of the table is slightly higher in the CSL tune is that the difference in cams allows for a slightly longer intake period which allows for slightly more mixing time?

[ac427]

Just a few percent higher seems to cause instability. I believe you want the air velocity high enough for effective fuel mixing, so if you open the throttles too much you pass a sad point of no return. They really seem to have pushed it pretty close to the max as far as I could tell when playing with that variable.

Ah, fair enough. I'll settle for proper part throttle performance every time.

[Bry5on]

Could the limit be raised though?

Just a few percent higher seems to cause instability. I believe you want the air velocity high enough for effective fuel mixing, so if you open the throttles too much you pass a sad point of no return. They really seem to have pushed it pretty close to the max as far as I could tell when playing with that variable.

[ac427]

You do not want to defeat that unless you enjoy a motor that has unstable combustion and pings!

Could the limit be raised though?

[Bry5on]

karter16 So is the hunt on to find a way of defeating the throttle plate limititation before 3000RPM or is that just enabling 'Sport Mode' ?

What are ARBID's?
i guess they are ARB ID's but what are they for?

You do not want to defeat that unless you enjoy a motor that has unstable combustion and pings!

[ac427]

karter16 So is the hunt on to find a way of defeating the throttle plate limititation before 3000RPM or is that just enabling 'Sport Mode' ?

What are ARBID's?
i guess they are ARB ID's but what are they for?

[karter16]

karter16 compare those opening maps with the euro tune, it'll help you avoid pinging - you found the difference that you never found.

❤️ haha so that's what you were referring to :-)


Sent from my iPhone using Tapatalk

[Bry5on]

karter16 compare those opening maps with the euro tune, it’ll help you avoid pinging - you found the difference that you never found.

[heinzboehmer]

I have no idea what scenario it's trying to mitigate. If someone wants to give it a go and report back on whether they can detect any difference that would be super cool.

Hmm, maybe this has something to do with setting the emissions readiness for the post cat O2s? Wild guess, but that's the first thing that came to mind when you mentioned steady state driving.

Also, just came back from my lunchtime test drive. Did it a little differently, mostly because I hadn't read your post before heading out

This is what I did:

1. Take car out for a spin without modifying anything in the tune. Made sure to hit redline in first, starting from 2500 rpm.
2. Set K_NOISE_CFG to 0x00, flash DME.
3. Repeat step 1.

I noticed zero difference, which makes complete sense based on your findings. My dreams of a secret burnout mode are crushed.

[karter16]

Okay so this is very limited.

Essentially what it does is monitor for the condition where the car is in 4th gear and has been cruising between 44 and 54 km/h for more than 3 seconds. At that point it enters "noise" mode where the max requestable torque is limited. As soon a different gear is selected or the car drops below 44 km/h or goes about 70 km/h noise mode ends.

It's worth noting that in the 1801 binary the parameters are different (3rd gear instead of 4th, and speed thresholds differ) so this has been tuned specifically for the CSL binary.

So it's super restricted. I have no idea what scenario it's trying to mitigate. If someone wants to give it a go and report back on whether they can detect any difference that would be super cool.

To validly test this.

Control test
1: Drive in 4th gear and maintain speed between 44 and 54 km/h (28-33 mph) for more than 3 seconds.
2: Boot it and monitor noise and acceleration. (bonus points for logging rather than going by feel)

Test
1: Turn noise control off by setting K_NOISE_CFG to 0x00.
2: Drive in 4th gear and maintain speed between 44 and 54 km/h (28-33 mph) for more than 3 seconds.
3: Boot it and monitor noise and acceleration. (bonus points for logging rather than going by feel)


Bry5on and heinzboehmer - with regard to limits at low speed/rpm it is worth noting that the DME DOES limit throttle plate opening below 3000 RPM. (I have no idea whether there's anything at all to be gained by making any change)

This is controlled by KF_EGAS_WDK (when CSL flap is closed) and kf_egas_wdk_ask (when CSL flap is open). Now I'm not suggesting that there's a whole bunch of torque hidden there or anything, and (if there is anything to be gained at all in terms of torque and/or noise) I would imagine that changes to this would require co-ordinated changes across timing, fueling, VANOS tables, etc. but there are a range of reasons the engineers might have done this and some of it might have been for noise control and for smoother application of torque.

Some tuners do make changes to this (interestingly some actually reduce the throttle plate opening further under 3000 rpm, I wonder what the reasoning for this is, or maybe it's to enhance the feeling of the car coming onto the power), although amusingly they do so only to KF_EGAS_WDK (after having lowered the CSL flap open threshold) so half the time the adjustments they've made aren't actually in effect. Given kf_egas_wdk_ask was only identified when I worked through the disassembly hunting the "CSL specific" parameters I would suspect they simply weren't aware that the table exists. The more I see of some tunes the more I do wonder how much they understand everything they're doing.

Please note: I am NOT in any way suggesting that I have the skills of a professional tuner or that I can do a better job than them. But simply reading some changes in the context of the disassembled code it does appear that people don't always actually understand what they changes they are making do and the effect that they do (or in this case don't) have.

[karter16]

I haven't worked through the logic end to end, but pretty sure this is quite limited compared to being a blanket suppression of max torque under 60kph, I think it's targeting only certain conditions, but let me work it through.