Ferrari 360 Swiss Army Knife by 360trev!

Just did an update today to bring up the level of F430 supported by Swiss Army Knife (SAK). It also now supports 575M and any other 1Mb roms in this area (e.g. ironically it works on Maserati GranSports too (and probably quite a few other models) as a happy "unintended consequence" of the flexible heuristic search modelling I'm using. It clearly shows that the same software was used on both Maserati and Ferrari by Bosch and Ferrari.

It now can correctly identify the Exhaust Valve Map tables as per the 360 support.

*What's interesting about this when comparing the F430 vs 360 (including Challenge Stradale) is that on the 360 you need at least 40% throttle before the valves start to open and you need to be at least above 5300 rpm. So imagine you rev the engine and downshift into a corner if you back off throttle below 40% the valves will close even if your over 5300rpm! This isn't great for chocking up performance or even grip/stability in some circumstances...

Its however mapped quite differently on F430 in that you only need 26% throttle to get those valves opening and even if you apply 0% throttle and your above 5900rpm the valves STAY open. Which makes sense, at higher rpm's it means it can still take advantage of the lower back pressure. The valves closing could otherwise mean choking of some performance and causing unintended consequences of a jolt.

I think I will offer the ability to use F430 valve mappings on the 360 for improved performance. Got to test this...

** Depending on firmware file for different geographical areas and also Model years this was played with quite considerably (most likely to comply with noise emissions) **

 

Backup/Restore
You can at any time backup and restore your ECU just like backing up a USB pen but a bit more complicated the way the process works.

This includes your original data including all the pairing information stored as well as firmware image (which contains maps, calibrations and firmware code, the logic which enacts upon the stored maps). So pretty much you can clone everything onto a second hand used ECU (something Ferrari main dealers cannot offer, in dealer based situation you have to buy 2 NEW ecus, hence bills for $6,000+ when an immobilizer or single ecu fails). Your backup becomes a 1:1 copy of your original ecu (a backup clone copy if you like). Even if you have no intention tweaking the settings personally, having a backup of your pairing is rather useful, from it you can for instance derive the original pin (or even change it if it ever got revealed!) or virginize to allow it to be repaired against another vehicle (exactly like buying a brand new never used ecu)...

Within the dump files there are distinct areas which contain maps and code.

It also doesn't really matter if you ecu's previously have been tuned or not. The way SAK works is quite clever meaning it can even work on tuned rom files no problems. You may or may not be surprised to discover that the vast majority of tuners simply don't have the expertise in these old embedded microcontrollers or the huge levels of time and commitment required to spend time to understand exactly how they work. It is VERY time consuming to do what I've done and reverse engineer the entire firmware. That is work out how all of the logic and code works and be able to make changes to it. This code is analogous to MS Word, with the documents equivalent of the maps. Tuners just alter a few pages in a document, i.e. tweaking of the original maps. I can do the equivalent of taking MS Office 2007 and extending its features, correcting bugs, altering the way it works, not just editing documents. Many tuners only alter a few basic maps. I.e. they don't need to or actually ever do full car level calibrations beyond basic air to fuel ratio's at given rpm's. That's not to take anything away from their work as often this requires many many hours on a dyno to get just right. Its time consuming and requires both experience and knowledge gained over years.

Full calibration are typically done by Bosch with senior engineers from a brand like Ferrari. This is done in order to adapt the base ecu to the Ferrari engine during development phases and to make it work with whatever sensors and actuators are fitted.

So even if a tuner alters maps I can see exactly what they did and do a forensic analysis (something I may offer as a service later, not a rate my tune but you will know exactly whats been changed or can see the changes in the maps). So only the most experienced tuners who've actually taken the time to fully calibrate and not just do a quick and dirty flash with bought in maps done by someone else will be evident. The sheer number of calibrations done by Michelotto for example shows the level of depth they went to, this was no slapdash outfit and its evident when you analyze what they changed. You can compare the original base maps against the tuned ones and see whats been done. Its impressive. The reason why I consider this important is that I was horrified to see that some of my friends who'd had tunes where using quite dangerous hacks. One tuner whom shall remain anonymous had disabled many of the self test safety checks to make it easier them to patch in tuned maps. One of these safety checks just happened to be the self testing of the Throttle Pedal so if it had failed you wouldn't know about it and the car wouldn't fall into limp mode but maybe instead accelerate at Wide open Throttle (100%!) from a cold start in your garage that wouldn't be a good thing.... So yes, I'm always interested to see whats been changed and verify if its been done safely or not.

 

The aim is to use OBD eventually... Currently its done out of the car. I've already written a security access bypass patch but to use that you need to have flashed the ecu's once before hand. Once done the first time every subsequent time should be possible via obd (still testing) and more information as it happens.

 

Cat Temperature

The whole cat control ecu's, themocouples and associated 'Slow Down' light are well known as a failure point on the 360 and every other model that has them.

The cat ecu's themselves don't do an awful lot except convert the 12V non-linear resistance coming out of the thermocouple temperature probes into a voltage in the range of 0 volts to 5 volts that represents the current temperature at the probe inside the exhaust.

This of course must including linearizing and conditioning the output so that it correctly represents the temperature range we are looking to view.

I've now had the luxury of fully disassembling the control strategy inside of the engine ecu's so I can finally bring the knowledge of exactly how they operate to the community.

Firstly here is the representation of what expected at given voltages.. The table to linearize the voltage actually looks like this..

Voltage, Temp, Value
5.0V 1,200 Deg C 250 value
4.5V 1,100 Deg C 230 value
4.0V 1,000 Deg C 210 value
3.0V 800 Deg C 170 value
2.5V 700 Deg C 150 value
2.0V 600 Deg C 130 value
1.5V 500 Deg C 110 value
1.0V 400 Deg C 90 value
0.5V 300 Deg C 70 value
0.0V 200 Deg C 50 value

This is actually sampled and represented internally inside the engine ecu's as an 8-bit (i.e. a value between 0-255) integer. (see table above).

The value once conversion from Analogue to Digital has occurred.

So 200 Deg C is represented as 50 in decimal
So 100 Deg C is represented as 25 in decimal.
So 10 Deg C is represented as 2.5 in decimal.
So 1 Deg C is represented as 0.25 in decimal (which cannot be represented in an 8-bit value in this chosen modelling range). So since we only use 8-bit notation the smallest difference in temperature is actually 4 degree's which is represented by increasing value by 1 in decimal. This means the resolution is restricted to measuring 4 degree increments in temperature. More than ample for this job.

The cat ecu therefore will be outputting;
5V when the maximum temperature of 1200 degree's is reached and this will be converted to an 8-bit value of 250 inside the ecu.

--

Now that we understand that lets look at why 'faking this voltage' doesn't really work...

You cannot just say slap a voltage, say of 2.5v (representing 700 degree's) and hope this will be sufficient since the ecu does plausibility checks and verifies the temperature against a model from the o2 sensors. Sadly those models don't measure high enough (1200 degrees) to be an entire replacement for the cat ecu's. So if you simulate a temperature and it doesn't match up with what it expects to see (within a tolerate of 100 degree's is what the model uses) it will illuminate the CEL. The easiest way to disable Cat ECU Monitoring is by modifying the firmware which is exactly what Swiss Army Knife can do to entirely disable the feature so no CEL is ever generated. This is useful if you have a full cat delete for example. It makes zero sense to do these checks if the cats are gone as they are only here to prevent damage to the cats from overheating/overfuelling situations.

How it works:
The first check done is to see if the engine has just been started, i.e. within the last 5 seconds. If it is it ignores the checking

The second check is to see if the temperature (tmot) of the engine is lower than 69.75 degree's. If it isn't it ignores the checking.

The next check is to see if the cat exhaust model is over 510 degree's. If it isn't it ignores the checking.

Next it takes the Analogue voltage and linearizes it into an 8-bit sample (see above explanation).

It now checks if the current temperature (from the Cat Ecu's) is more than 1,150 degrees over a period of 2 seconds (de-bounce time to eliminate fluctuations),
if it is the CEL is illuminated. Either P1449 for LHS or P1445 for RHS.

It now checks if the current temperature (from the Cat Ecu's) is less than 220 degrees over a period of 2 seconds (de-bounce time to eliminate fluctuations),
if it is the CEL is illuminated. Either P1449 for LHS or P1445 for RHS.

Catalyst temperature for plausibility check. It now checks if the cat temperature is less than 320 degree's. if it is the CEL is illuminated. Either P1449 for
LHS or P1445 for RHS.

The Catalyst temperature model checks if the cat temperature is within 100 degree's of the cat ecu's measured temperature and finally saves a variable
called 'katm'.

--
Catalyst Protection Active

Next up a separate method is used to enforce catalyst protection. Again this can be deactivated by Swiss Army Knife.

This is then used by the exhaust temperature cat protection routine, in this case if 960 degree's is exceeded and throws the CEL of P1454 for LHS or P1446
for RHS which are for Catalyst Protection Active.

There is a Dwell time until fuel cut off occurs of 2 seconds so during this time the temperature can go up some more (some have observed +40 degree's)
before the fuel cut kicks in.

Hope this description is useful to some people in our community.

 

Forgot to mention its really easy in SAK to change the linearization parameters to be different so as to match an off the shelf alternative to the overly expensive Cat control stations. Rather than trying to find one that matches exactly to above I can adjust the table to reflect what your sensor outputs. This way you could for instance offer alternative (i.e. low cost) equivalent themocouplers and voltage adaptors (ecu's if you must) from another marque..

 

See pics.. The 430 does in fact have a thermocouple however it doesn't have a cat ecu since the conversion to digital is delt with on the newer series of Bosch ecu's directly within the ecu itself, not with some hack job external pcb with resin glued in like on the older series cars
Image Unavailable, Please Login

 

I'll come back to you on this. Sorry been busy working on the tool...

 

After some work today I managed to get SAK tool to do a full delete of the evap canister purge valves.

And also I will write a guide on how to test the purge valves and wiring. More to follow... Image Unavailable, Please Login

 

I've been very busy working on SAK tool lately. I am currently running (test mule) software generated by my SAK tool from 05' spec CS base firmware (yes the VERY last firmware) on my own car with extensive data logging.

As you can imagine this requires extensive testing as I am doing a lot of improvements to the software. Here's the extensive changes which can now be executed or are a work in progress. If there is anything else people want in Release #1 let me know as soon this list will be 'locked down' until its feature complete.

• Raised rev limiter, up from 8,600 rpm upto 9,000~9,100 (+/- 100), extending maps where necessary. I've ran it up as high as 9,250, actually point is fully adjustable up to 9,150.
• Eliminated the delay time for Driver requested torque (snappier acceleration)
• Conversion Parameters for Gated Operation (F1 or Gated supported)
• Immobilizer completely disabled within the firmware (no authorization to start required) or its parameters adjusted such as re-arm activation time up from default of 29.44 seconds re-arm.
• Seedkey authorization deactivated. This means OBD login works without a password for reflashing over OBD
• Sport Exhaust Valves mapping (currently working on Switchable on the sport button!) with button switching to Stage II Maps based off the analysis of 360 Challenge and Michelotto's work (approximately +440hp with larger AFM's and Sports Exhaust required - Not yet finished, more dyno work required*)..
• Option to upgrade to larger Fuel injectors (improve injector lag and allow power over +440hp to be made, more information to follow.)
• Option to upgrade to larger Throttle Bodies from F430.
• Air Injection Deactivated (whole system can be removed *)
• Fuel Tank Pressure Deactivated
• EVAP Canister valves Deactivated (whole system can be removed *)
• Catalyst Efficiency Monitoring Deactivated (even with test pipes it works)
• Catalyst Temperature 'Cat ECU' Monitoring Deactivated
• Catalyst 'Slow Down Light' Monitoring. Either disabled or patched use O2 estimation model (which is ~100 degrees within tolerance of Cat Ecu's).
• Secondary O2 Sensors (post cat) Deactivated (can be removed and install just a bung).
• ASR/ESP/ABS Adjustment for Rim size (no ABS issues when fitting larger tires and rims).
• Switchible Fuel Cut delay (Pops and bangs during gear changes)
• Launch Control with adjustable rpm setting (working on self learning for point of slip on a given surface!)
• Advanced Telemetry & Data Logging for real-time viewing on a tablet and offline storage.
• Readiness Simulator (strictly for off road use *).

The result of all of this is you can remove a lot of things that go wrong;

1. Pair of Secondary O2 sensors removed.
2. Whole air injection system can be removed.
3. Whole Charcoal canister and evap system, fuel evap disarator, solenoid valves can be removed, all plumbing and just fit one way shut off valves at fuel tank..
4. Whole Cat ecu's and thermistors can be removed (bungs fitted) - replaced with an estimation modelling.

This lot transforms the car and makes it much more reliable.

 

Forgot to mention not all features will be road legal in your jurisdiction so you need to check if its the case or just use the sw on track days. Everything is configurable.

 

I wanted it cross architecture so I've developed it in portable C with endian abstraction. This means I can run it ported onto pretty much any architecture or platform. If C is written with portability in mind it can run on anything... From Linux, to Mac to Windows to Android to an old 16 bit microcontroller on an RTOS