Quirks!

[RobertISaar]

busy hacking through some 94-95 3800 code(5B), found something that i forgot about seeing in a derivative before.... 1FA and 2E are basically slimmed down versions of 5B, but their applications were a bit different... 1FA/2E was used on 3100 and 3.4DOHC, while 5B was used on the 3800. i don't work with the 90V6 engines very much, which is why i saw it on the 60V6 application first.

anyways, plowing through the calibration and i found something odd with the main spark tables... here's a quick rundown of the code concerning it:

check if above 4800RPM
if so, lookup high RPM spark table (2D) (8115)
if not, lookup main spark table (8022)

well... the main spark table only actually goes to 4400RPM... but since the 4800 and up table is immediately after the main table, it actually lines up and will be looked up as another row. the code doesn't attempt to limit reading above 4400RPM either...

so, it acts like a single 400-4800RPM table, but in the code it's actually a 400-4800RPM table and a 4800+ RPM table.... essentially, the extra lookup for 4800+ is pointless since it will already be used.



so, anybody else find odd things they want to discuss/share?

[EagleMark]

Hard to compete with you but I'll play and maybe learn something?

$4F XDF Fuel VE table goes to 5200 RPM, but the assembly only goes to 4800? Somone started at 400 RPM instead of 0 RPM.

Odd? Have you ever seen how much Air managmant code is in a $6E assembly? And I can't find a way to turn it off? In $42 it's just a temp on and timer...

Since I'm stating to understand looups and sub routines how about a lesson on the commands? I just grabbed this piece and BOLD, Italic and UNDERLINED some examples.


;--------------------
; LK UP ACCEL ENRICH
; vs Diff TPS
; ** PUMP SHOT **
;--------------------
D775: LDAA #255
D777: LD777 LDX #$D312 ; ACCEL ENRICH vs Diff TPS TBL
; Contrib vs Diff TPS TBL
D77A: JSR LFAD7 ; 2D LK UP
;
D77D: LDAB L00DF
D77F: ORAB #$10 ; BIT 4
D781: BRA LD786
;
D783: LD783 CLRA
D784: ANDB #$EF ; 0111 1111
D786: LD786 STAB L00DF
D788: STAA L0058 ; BPW, MSB
D78A: STAA L009A
D78C: CLRA
D78D: LDAB L00DF
D78F: BITB #4 ; BIT 2
D791: BEQ LD796
;
D793: LDAA LD28F ; 183 Usec, BPW ADDER TO BPW WHILE
; IAC IS OPENING
; VAL MSEC = 16.384

D796: LD796 ADDA L0058 ; BPW, MSB
D798: BCS LD79E
; ... else
D79A: ADDA L0059 ; BPW, LSB
D79C: BCC LD7A0
; ... else
D79E: LD79E LDAA #255 ; MAX LMT
D7A0: LD7A0 BEQ LD7BE
;
D7A2: LDAB L0098
D7A4: MUL
D7A5: LSRD ; DIV BY 8
D7A6: LSRD
D7A7: LSRD
D7A8: ADDD L0096
D7AA: STD L0096
D7AC: LDAB L0006
D7AE: LDAA L000D
D7B0: BITA #$40 ; BIT 6
D7B2: BNE LD7B6
; ...... else
D7B4: ORAB #8
D7B6: LD7B6 ORAA #$C0 ; 1100 0000
D7B8: ORAB #1 ; BIT 0
D7BA: STAB L0006
D7BC: BRA LD7C2

D7BE: LD7BE LDAA L000D
D7C0: ANDA #$BF ; 1011 1111
D7C2: LD7C2 STAA L000D
D7C4: LDAB L0072
D7C6: BITB #2 ; BIT 1
D7C8: BEQ LD7DD

[RobertISaar]

i don't see anything bolded? the [ code ] command seems to disable a lot of formatting.

AIR management should be able to be disabled completely with relative ease.... there have to be calibration scalars that could be manipulated to remove it entirely.

[jim_in_dorris]

I'm not sure if I see it correctly myself, but it looks like this is highlighted. If I may.



LDAA #255
D777: LD777 LDX #$D312 ; ACCEL ENRICH vs Diff TPS TBL
; Contrib vs Diff TPS TBL
D77A: JSR LFAD7 ; 2D LK UP ;
D77D: LDAB L00DF

LDAA and LDAB are Load Accumulators A and B.
LDX is Load index register X.
and JSR is Jump to subroutine.

What that piece of code is doing is loading accumulator A with $FF(256), loading the index register X with the address of the routine it wants (ACCEL ENRICH vs Diff TPS TBL)
then jumping to that subroutine to do a lookup. on return it then loads the B accumulator with the contents of $DF which is a status flag most likely. I'm not looking at the
hac of whatever piece of code that come from, but I feel confident that is what is happening

[RobertISaar]

more quirks from 5B....

the IAT correction to spark advance table.... instead of using normalized IAT, it's using raw A/D counts..... ???? it also has an upper limit of $D1 counts, not $D0 as expected... this complicates things a bit to try and get everything labeled correctly in the XDF.

so, within an hour or so of hacking/commenting, i've run across two really big mistakes in 5B... this one can be fixed with a single byte change, the other requires a bit of branching. wonder what else i'll find.

[EagleMark]

That was hard to see bold, I changed it to bold, Italic and underline... but Jim caught it and now I can spend some time with that info! :thumbsup:

I don't want to hijack but I need some help and it's Quirk related.

BJYK has Mode 4 commands in the hex starting at $1800, BJYL and the available dissasmbly do not. What does Mode 4 do and how would it affect whatever?


Location of ALDL mode 4 jump table and code in PROM
;
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
;
;-Not present in this calibration, dummy RTS table provided for this disassembly
;
ORG $1800
;
L1800 NOP ;
NOP ;
RTS ;Return
;
L1803 NOP ;
NOP ;
RTS ;Return
;
L1806 NOP ;
NOP ;
RTS ;Return
;
L1809 NOP ;
NOP ;
RTS ;Return
;
L180C NOP ;
NOP ;
RTS ;Return
;
L180F NOP ;
NOP ;
RTS ;Return
;
L1812 NOP ;
NOP ;
RTS ;Return
;
L1815 NOP ;
NOP ;
RTS ;
;

[RobertISaar]

mode 4 allows you to temporarily change values on-the-fly. example that applies to most calibrations is being able to change the target AFR or spark advance. others would be being able to command outputs on/off. others still are being able to reset the learned BLM cells to 128 or updating the learned IAC minimum to whatever you want it to be.

odd that the table exists but is filled that way... the good news is that since there are 3 bytes in place, one byte can be used for JSR/JMP and the other two for the jump address. assuming the rest of the code didn't exist, then with some skill, you could impliment whatever mode4 commands you want.

[EagleMark]

That's what I though Mode 4 was, weird it is in this bin, it is not in simalar year bin, I also found it in $6E so mode 4 has been around a long time, I've never noticed it in others... woo hooo I found a quirk!

So it will not effect a thing unless mode 4 commands are sent? Like Mode 1 commands are sent from ADX file. It's like an emulation?

[RobertISaar]

mode 4 capability is present in MOST P4 and i would imagine all P6 units. some of the very early units don't seem to have it, but i've found stuff as far back as 1989 at least that have it.

correct, mode 4 is only used if the ALDL device(laptop in this case) requests it. it's kind of like temporary emulation, but GM built it intending to be used for diagnostics. then you have MonteCarSlo who modified the normal mode4 stuff to use the NVSRAM module to allow that stuff to happen.

[1project2many]

$8D and $58 both support mode 4. It was touted as a big deal when "bi-directional" diagnostics came into play but it turned out that it didn't make a ton of difference.

$58 has a BSR or JMP at the end of a section of code which can never be executed. Just a one liner and it may even reference an address that's not in the code. With throttle closed only the 600RPM row of spark values is used in the main spark table even if rpm > 600. I believe this is due to GM's intention to use spark adjusted idle speed control which is coded in but isn't active in any cals I've seen. I've had good results adding a test to see if the vehicle moving flag is set before locking spark to the bottom row. GM also included an injector size constant in $58 but it's only used for fuel economy calculations. And most cals enable fuel economy calculations even though the only place the data is available is at the HUD / diagnostic dashboard used by engineering.

[RobertISaar]

the behavior of only using the lowest RPM row with closed throttle..... is there a flag to disable it? all of the 60V6 calibrations have the option to use it, some have it enabled, i always disable it.

actually, the 60V6 stuff has pretty much all of those $58 oddities... most were useful though, the trip computers were quite nice/accurate for their time. the Oldsmobile DIS(driver information system) units actually had a hidden diagnostic mode that was entered by key-ing in the code of "8192".

[1project2many]

No flag to disable 600 rpm row.
Data from mpg calculation is not available to any vehicle instrumentation... only to giant, 1960's looking diagnostic tool that GM Calibration engineers had access to through edge card connection.

I have two or three of the 3.8 Olds / Buick onboard touch screen CRT systems here. Once upon a time I had dreams of installing one in my Chevelle and modifying it to work with a different ecm.

[RobertISaar]

so, $58 doesn't output the running total of fuel injected in mSec(along with a bunch of other values) when there is nothing else commanding the ALDL stream? odd.... then again, i don't think any $58 application ever had a trip computer, so i guess it was never really needed.

http://carphotos.cardomain.com/ride_images/1/1102/1041/2753020005_large.jpg

that's my preference when it comes to trip computers... oldsmobile used them(or at least had the option) in almost everything they sold for a couple of years. i love the glow of a good vacuum fluorescent display.

[1project2many]

Technically, the entire $58 data stream might be called a quirk thanks to some issues with timing that don't seem to be present in most other cals. If it weren't for the boost related code, I think most people would decide that mask is more trouble than it's worth.

I think I have one of those displays along with the HVAC and CRT from a Tornado / Trofeo.

[RobertISaar]

A8(91-?? Quad4): hardcoded hardware cylinder select values. if hardware and software don't match, all fueling is disabled. looks like GM definitely didn't want this code on anything other than MPFI 4 cylinders. considering the other dependancies in the code for other signals that only would have been present on the Q4, seems overkill.



ROM:AD37 ldaa byte_3D ; FMDBYTE2 FMD BYTE 2 MODE WORD
ROM:AD37 ; 0 EST COMMAND 1 = YES 0 = NO (1 = COMMANDED)
ROM:AD37 ; 1 NOT USED
ROM:AD37 ; 2 NOT USED
ROM:AD37 ; 3 M0 MODE DECODE: REFA, REFB FROM TREF
ROM:AD37 ; 4 M1 MODE DECODE " "
ROM:AD37 ; 5 0.4V AT SENSE RESISTOR OF INJECTOR
ROM:AD37 ; 6 INJECTOR OR HARNESS SHORTED TO BATTERY
ROM:AD37 ; 7 INTERRUPT DUE TO FMD ON RISING TREFB
ROM:AD39 anda #$18 ; ignore all but bits 3 and 4
ROM:AD3B cmpa #$18
ROM:AD3D beq loc_AD45
ROM:AD3F bset byte_8 $10 ; MALFFLG3 MALF FLAG WORD 3
ROM:AD3F ; 0 MALF CODE 65 INJECTOR P/N
ROM:AD3F ; 1 MALF CODE 62 GEAR SWITCH FAULT
ROM:AD3F ; 2 MALF CODE 53 OVER VOLTAGE
ROM:AD3F ; 3 MALF CODE 31 BARO SENSOR (LOTUS ONLY)
ROM:AD3F ; 4 MALF CODE 51 PROM ERROR
ROM:AD3F ; 5 MALF CODE 45 O2 SENSOR RICH
ROM:AD3F ; 6 MALF CODE 44 O2 SENSOR LEAN
ROM:AD3F ; 7 MALF CODE 43 ESC FAILURE
ROM:AD42 bset byte_3 4 ; MWNV2 NON-VOLATILE MODE WORD2
ROM:AD42 ; 0 1 = MALFUNCTION 41 (MISSING 1X) ACTIVE
ROM:AD42 ; 1 1 = MALFUNCTION 41 DETECTED THIS IGNITION CYCLE
ROM:AD42 ; 2 1 = WRONG MODE ON FMD (CALPAK ERROR)
ROM:AD42 ; 3 1 = EGR SOL. #1 FAILED - M32 (AND HASN 'T PASSED SINCE)
ROM:AD42 ; 4 1 = EGR SOL. #2 FAILED - M32 (AND HASN 'T PASSED SINCE)
ROM:AD42 ; 5 1 = EGR SOL. #1 PASSED M32 THIS IGNITION KEY CYCLE
ROM:AD42 ; 6 1 = EGR SOL. #2 PASSED M32 THIS IGNITION KEY CYCLE
ROM:AD42 ; 7 NOT USED

[EagleMark]

Wonder if that is going to be an issue with my A8 and a DIS/ICM change?

[RobertISaar]

as of this moment, i'm not certain. it is likely possible to remove the necessity of the 1X signal from the code and have it act normally otherwise, but i can't say for certain yet.

[RobertISaar]

8009, bit 5 is definitely 1X signal related.... when the flag is not set, a bunch of 1X related stuff is bypassed entirely.

that may be the easiest answer.

[delcowizzid]

mode 4 is handy on 4l60e cars and 4l80e so you can command 3rd gear hold on the dyno so you dont downshift at full throttle