EE dissection

[steveo]

decided to start a thread just to follow along the stupid observations im making about EE code, just in case anyone is interested or has any pointers, or wants to watch a total ameture try to blunder his way through 68k assembly for entertainment purposes.

posts to follow

wish me luck

[beestoys]

Good luck Steveo
Hope you can unlock some of the uncharted territory. You have been a big help to me. I'll stick to the basic tolls for now and follow in others footsteps here.

[steveo]

tonight looking at a mystery bit i've always been interested in, discovered by lt1edit's author a long time ago, which he labeled as disabling CCP fueling calcs and otherwise labeled as 'transient fuel' but never quite investigated.

it's in E-side 0x2028, bit 6.

observationally, setting/unsetting this bit does not tickle the butt dyno very much, so it must be a fairly subtle change.

that byte seems to contain some primary flags, as it also contains the known/documented bits for:

- f-body VATS enable
- traction control spark retard enable
- air pump enable
- force speed density mode.

it's used for a branch at 0x6588:



6588 B6 20 28 @241 ldaA b_2028_sw_b3vats_b2spddens_b0tcs
658B 85 40 bitA #%01000000 ;what switch bit
658D 26 03 bne @242 ; if switch bit is set, do lookups
658F 7E 67 13 jmp @269 ;else (if bit clr) skip what f(cooltmp,load) lookups


that bit enables/disables a particularly gigantic fueling calc subroutine;



6592 B6 01 68 @242 ldaA l_0168_RPM_31.25/bit
6595 81 80 cmpA #$80 ; 4000 rpm
6597 25 06 bcs @243 ; br if RPM<4000
6599 96 A5 ldaA l_00a5_countr_skip_lkups ;else
659B 81 06 cmpA #$06
659D 26 76 bne @252 ; maybe skip lookup of what f(cooltmp,load) wallwetting?
659F B6 01 93 @243 ldaA l_0193_CoolTmp_fltrd_$f0_max_$e0
65A2 F6 01 6B ldaB l_016b_(ADMAP-26)*151*2/256
65A5 54 lsrB
65A6 54 lsrB
65A7 CE 26 F2 ldX #$26F2
;; lkup3d_sub: ; A row, B col, X tbl addr, A returned val
65AA A0 00 subA 0, X ; CALC ROW ARG OFFSET, (LIMITED TO 0)
65AC 24 01 bcc @244
65AE 4F clrA ; ... ELSE
65AF E0 01 @244 subB 1, X ; CALC COL ARG OFFSET, (LIMITED TO 0)
65B1 24 01 bcc @245
65B3 5F clrB ; ... ELSE
65B4 3C @245 pushX ; XFER TABLE ADDR TO Y REG
65B5 18 38 popY
65B7 36 pushA ; SAVE ROW ADDRESS
65B8 86 10 ldaA #$10 ; SPLIT COL ARG INTO TABLE OFFSET
65BA 3D mul ; & INTERP PORTION
65BB 37 pushB ; SAVE INTERP PORTION TO STACK
65BC 16 tAB
65BD 3A aBX
65BE 33 popB
65BF 32 popA ; GET ROW ARG
65C0 37 pushB
65C1 C6 10 ldaB #$10 ; SPLIT ROW ARG INTO R
65C3 3D mul ; TABLE NUMBER
65C4 37 pushB ; (MAX RESULT IS 255D)
65C5 18 E6 02 ldaB 2, Y
65C8 3D mul
65C9 3A aBX
65CA 3C pushX
65CB 18 E6 02 ldaB 2, Y
65CE 3A aBX
65CF 18 30 tSY
65D1 EC 03 ldD 3, X
65D3 10 sBA
65D4 18 E6 03 ldaB 3, Y
65D7 24 06 bcc @246
65D9 40 negA
65DA 3D mul
65DB A9 03 adcA 3, X
65DD 20 06 jr @247
;
65DF 3D @246 mul
65E0 89 00 adcA #$00
65E2 40 negA
65E3 AB 03 addA 3, X
65E5 38 @247 popX
65E6 36 pushA
65E7 EC 03 ldD 3, X
65E9 10 sBA
65EA 18 E6 03 ldaB 3, Y
65ED 24 06 bcc @248
65EF 40 negA
65F0 3D mul
65F1 A9 03 adcA 3, X
65F3 20 06 jr @249
;
65F5 3D @248 mul
65F6 89 00 adcA #$00
65F8 40 negA
65F9 AB 03 addA 3, X
65FB 33 @249 popB
65FC 36 pushA
65FD 10 sBA ; Y1 - Y2
65FE 18 E6 02 ldaB 2, Y ; FRACTION MULT
6601 24 07 bcc @250 ; BR IF D >= 0
6603 40 negA ;ELSE INTERP Y (RND UP IF Req)
6604 3D mul
6605 18 A9 01 adcA 1, Y
6608 20 07 jr @251
;
660A 3D @250 mul
660B 89 00 adcA #$00
660D 40 negA
660E 18 AB 01 addA 1, Y
6611 31 @251 incS
6612 38 popX ; end of lkup3d, result in A
6613 97 FD staA L00FD
6615 B6 01 68 @252 ldaA l_0168_RPM_31.25/bit
6618 81 80 cmpA #$80 ;4000 rpm
661A 25 06 bcs @253 ; br if RPM<4000
661C 96 A5 ldaA l_00a5_countr_skip_lkups ;else
661E 81 07 cmpA #$07
6620 26 77 bne @262 ; maybe skip lookup of what f(cooltmp,load)
6622 B6 01 93 @253 ldaA l_0193_CoolTmp_fltrd_$f0_max_$e0
6625 F6 01 6B ldaB l_016b_(ADMAP-26)*151*2/256 ; (ADMAP-26)*151*2/256
6628 54 lsrB ;*2
6629 54 lsrB ;*2
662A CE 28 45 ldX #$2845 ;B=(ADMAP-26)*151*2/256*4
;; lkup3d_sub: ; A row, B col, X tbl addr, A returned val
;; INPUTs 1. R min value, (Rows) 2. Q min value, (Col's)
;; 3. RNUM, number of Q Vals, (col's) in each R table
;; 4. Thr 1st R table, R num entries in length
662D A0 00 subA 0, X ; CALC ROW ARG OFFSET, (LIMITED TO 0)
662F 24 01 bcc @254
6631 4F clrA ; ... ELSE
6632 E0 01 @254 subB 1, X ; CALC COL ARG OFFSET, (LIMITED TO 0)
6634 24 01 bcc @255
6636 5F clrB ; ... ELSE
6637 3C @255 pushX ; XFER TABLE ADDR TO Y REG
6638 18 38 popY
663A 36 pushA ; SAVE ROW ADDRESS
663B 86 10 ldaA #$10 ; SPLIT COL ARG INTO TABLE OFFSET
663D 3D mul ; & INTERP PORTION
663E 37 pushB ; SAVE INTERP PORTION TO STACK
663F 16 tAB
6640 3A aBX
6641 33 popB
6642 32 popA ; GET ROW ARG
6643 37 pushB
6644 C6 10 ldaB #$10 ; SPLIT ROW ARG INTO R
6646 3D mul ; TABLE NUMBER
6647 37 pushB ; (MAX RESULT IS 255D)
6648 18 E6 02 ldaB 2, Y
664B 3D mul
664C 3A aBX
664D 3C pushX
664E 18 E6 02 ldaB 2, Y
6651 3A aBX
6652 18 30 tSY
6654 EC 03 ldD 3, X
6656 10 sBA
6657 18 E6 03 ldaB 3, Y
665A 24 06 bcc @256
665C 40 negA
665D 3D mul
665E A9 03 adcA 3, X
6660 20 06 jr @257
;
6662 3D @256 mul
6663 89 00 adcA #$00
6665 40 negA
6666 AB 03 addA 3, X
6668 38 @257 popX
6669 36 pushA
666A EC 03 ldD 3, X
666C 10 sBA
666D 18 E6 03 ldaB 3, Y
6670 24 06 bcc @258
6672 40 negA
6673 3D mul
6674 A9 03 adcA 3, X
6676 20 06 jr @259
;
6678 3D @258 mul
6679 89 00 adcA #$00
667B 40 negA
667C AB 03 addA 3, X
667E 33 @259 popB
667F 36 pushA
6680 10 sBA ; Y1 - Y2
6681 18 E6 02 ldaB 2, Y ; FRACTION MULT
6684 24 07 bcc @260 ; BR IF D >= 0
6686 40 negA ;ELSE INTERP Y (RND UP IF Req)
6687 3D mul
6688 18 A9 01 adcA 1, Y
668B 20 07 jr @261
;
668D 3D @260 mul
668E 89 00 adcA #$00
6690 40 negA
6691 18 AB 01 addA 1, Y
6694 31 @261 incS
6695 38 popX ; end 3dlkup, result in A
6696 B7 01 1C staA L011C
6699 CE 00 8A @262 ldX #$008A
669C DC 7A ldD L007A
669E A3 00 subD 0, X
66A0 DE A1 ldX l_00a1_ref_period_12x
66A2 BC 26 ED cmpX L26ED
66A5 25 0D bcs @263
66A7 DF FB stX L00FB
66A9 96 FD ldaA L00FD
66AB C6 52 ldaB #$52
66AD 3D mul
66AE 89 00 adcA #$00
66B0 16 tAB
66B1 4F clrA
66B2 20 0D jr @264
;
66B4 DD FB @263 stD L00FB
66B6 8F xgDX
66B7 96 FD ldaA L00FD
66B9 C6 F6 ldaB #$F6
66BB 3D mul
66BC 04 lsrD
66BD 04 lsrD
66BE 04 lsrD
66BF 04 lsrD
66C0 04 lsrD
66C1 DD FE @264 stD L00FE
66C3 8F xgDX
66C4 02 idiv
66C5 05 lslD
66C6 1A 93 FE cmpD L00FE
66C9 25 01 bcs @265
66CB 08 incX
66CC 8C 04 FF @265 cmpX #$04FF
66CF 23 03 bls @266
66D1 CE 04 FF ldX #$04FF ;max limit to $04ff
66D4 FF 01 00 @266 stX L0100
66D7 FC 01 00 ldD L0100
66DA 37 pushB ; D=index, set aside B
66DB 16 tAB ; A -> B, msb index, (index/256), A stays in A
66DC CE 28 40 ldX #$2840 ;
66DF 3A aBX ; X=X+(index)/256
66E0 A6 00 ldaA 0, X ; load table value f(msb L0100)
66E2 33 popB ; B, lsb index,
66E3 CE 27 40 ldX #$2740 ;
66E6 3A aBX ; X=X+(index)/256
66E7 E6 00 ldaB 0, X ; load table value f(lsb L0100)
66E9 3D mul ; A*B -> D
66EA 89 00 adcA #$00
66EC 40 negA
66ED B7 01 1D staA L011D
66F0 B6 01 1C ldaA L011C
66F3 40 negA
66F4 F6 26 F1 ldaB L26F1
66F7 3D mul
66F8 05 lslD
66F9 24 02 bcc @267
66FB 86 FF ldaA #$FF
66FD B7 01 1E @267 staA L011E
6700 B1 01 1D cmpA L011D
6703 23 03 bls @268
6705 B6 01 1D ldaA L011D
6708 B7 01 1F @268 staA L011F
670B CE 01 04 ldX #$0104
670E D6 A5 ldaB l_00a5_countr_skip_lkups
6710 58 lslB
6711 24 07 bcc @270


now i want to figure out what it does, and how i can screw around with it. if it's truly transient fuel calcs, perhaps we can get some pump shot out of it, or other fun things. and if it truly has compensation for CCP duty cycle air n' fumes, how can that be nerfed without taking the rest of the routine with it....

[steveo]

Good luck Steveo
Hope you can unlock some of the uncharted territory. You have been a big help to me. I'll stick to the basic tolls for now and follow in others footsteps here.

thanks bud i'll need it!

anything else i can do, let me know.. there's not a big lt1 crowd left that gives a shit, we have to stick together

[steveo]

first off the CCP element.

i see no real evidence that there's any link to a variable charcoal canister purge duty cycle, which is in t-side memory 022A. although possibly:

1. it's a static formula that assumes that the duty cycle will happen (seems unlikely, especially considering it doesn't have any knowledge of when the duty cycle will occur temp-wise, @ constant 0x2625 in t-side, or at what throttle positions, which is also on the t-side)

2. it does get the duty cycle from the t-side and i just can't see it

3. it was misunderstood in previous tuning software

next is investigate the table....

[steveo]

reviews of logs with this bit enabled/disabled in similar tunes do reveal substantial differences in BLM averages. this set of instructions is definitely doing.................something!

3d tables @ 0x26F5 and 0x2848 to play with, working on that now

[dave w]

I greatly appreciate your efforts / progress!:thumbsup:

dave w

[steveo]

all this table lookup code is tripping me up a bit; trying to figure out how to interpret enough it to confirm table dimensions. back to school with me for a while.

[steveo]

table at 0x26F2 appears to be, unless im misunderstanding it, 5x15 of map vs coolant, which means the fueling routine is probably fairly temperature oriented, and operates only at either really coarse or a specific range of MAP values.

this may point towards this actually being the wall pooling compensations

result stored in 0x00FD, used only once. it appears to make a choice based on rpm,



6699 CE 00 8A @262 ldX #$008A
669C DC 7A ldD L007A
669E A3 00 subD 0, X
66A0 DE A1 ldX l_00a1_ref_period_12x
66A2 BC 26 ED cmpX L26ED
66A5 25 0D bcs @263


whether to perform this calc on the result:



66A7 DF FB stX L00FB
66A9 96 FD ldaA L00FD ; load mystery value
66AB C6 52 ldaB #$52 ; multiply with dec 82
66AD 3D mul ; ..
66AE 89 00 adcA #$00 ; add carry bit of nil back to register? i don't understand that
66B0 16 tAB ; result to register b
66B1 4F clrA
66B2 20 0D jr @264


.. or this one



66B4 DD FB @263 stD L00FB
66B6 8F xgDX
66B7 96 FD ldaA L00FD ; load mystery value
66B9 C6 F6 ldaB #$F6 ; multiply with 246 ??
66BB 3D mul ;
66BC 04 lsrD ; ok im lost
66BD 04 lsrD ; 5 right shifts
66BE 04 lsrD ; need more coffee
66BF 04 lsrD ;
66C0 04 lsrD ;

[steveo]

staring at that last code snippet for a few minutes proves to me how noob i am with this stuff right now, so i gave it my best shot on a hunk of paper with the instruction set beside me.

my best guess is:

- multiplies our mystery table lookup result by 0xF6 into the 16 bit D register, a good choice since multiplying two 8 bits into a 16 bit is a very cheap operation for a processor. D must be a 16 bit, otherwise multiplication on 8 bit values would be rediculous.
- im thinking sequential right shifts on an integer of that size should result in exponential division to the number of shifts, so 5x LSRD is the equivalent of a less expensive version of /(2^5)

so this basically does (X*246)/32

can someone check my work to see if i'm even close?

[steveo]

if the first equation runs, though, $0x008A is subtracted from whatever is in 0x007A, which actually might be from the t-side?.. need to look at that more

so looks like whether rpm is a factor in whether _some other variable_ is used. this might actually be ccp related...?

scratch that i was missing a peice of the puzzle.

[RobertISaar]

looks right to me. depending on how the code afterwards deals with what is in D, the 246 could be a 246 multiplier or it could be 246/256(if only A were used afterwards, for example).

[steveo]

ahh good point, i'll keep an eye on it

thankya

[steveo]

this is taking a long time for me to figure, but I'm concluding pretty quick here that it performs more than one fueling compensation. might be wall wetting and something else in the same code block.

[fbody_Brian]

Very interesting

Subscribed!

[steveo]

right now i've kind of put specific disassembly on hold to try to document and comment the code a bit better; just so i can break things into code blocks and figure out what variables tie into what (which memory locations are fuel related, timing related, etc).

i figure if i grind at that for a few hundred hours it'll make my life easier in the long run, instead of just doing it as i go.

this is all a big learning experience for me too, never been this deep into this type of assembly code.

[fbody_Brian]

I'm sure it would make it easier in the long run, though I'm sure none of it will ever be truly easy. Wish I could help, but I know virtually nothing about assembly, only know c/c++, and some scripting languages like bash.

[steveo]

that's what im working with too, though. luckily c is low level enough where a good c programmer will recognize most machine code, at least in terms of how it's structured.

they're both weakly typed languages that rely on memory addressing (pointers) for reference, and data structres are built manually with pointer math-like things; no object orientation, just sets of instructions with jumps and compares to do loops or branching

remember c was written to be as close to machine code, it was from a time when compliation time and memory use were critical

should look some over!

if you are a unix lt1 guy you should check out my dash logger, i want someone else to build one, it's a fun toy, and since its in c you can hack it up to do whatever you want...

[fbody_Brian]

that's what im working with too, though. luckily c is low level enough where a good c programmer will recognize most machine code, at least in terms of how it's structured.

they're both weakly typed languages that rely on memory addressing (pointers) for reference, and data structres are built manually with pointer math-like things; no object orientation, just sets of instructions with jumps and compares to do loops or branching

remember c was written to be as close to machine code, it was from a time when compliation time and memory use were critical

should look some over!

if you are a unix lt1 guy you should check out my dash logger, i want someone else to build one, it's a fun toy, and since its in c you can hack it up to do whatever you want...

Most definitely a unix guy. I actually teach linux classes at a local junior college and have used it as my primary os since around 92. I was looking at your code on github and will check it out more when I have the time.

[steveo]

some of its pretty scabby, but the results are good!

http://fbodytech.com/images/aldlio.jpg

[steveo]

you know, brian, if you wanted to poke at it, you could learn this stuff pretty easy if you wanted

im still way behind, but you can figure a lot out just reading through the instruction set. it's all just a bunch of addressing and simple instructions, very similar to the ones that are spit out of your c code when you compile it.

there's an A and B register (8 bits each), and a D register that is just A and B together making a single 16 bit register, and a few others, X, Y, whatever.

these are for stupid fast temporary working storage of stuff, you have to load a memory address's contents into them, then operate on that register.

you just have to watch out for this special persistent set of bits called 'condition bits', which may or may not be changed or set by the results of practically any operation. they're whats used for branching.

the mnemonics of the disassembly is pretty englishy, ldaB is LoaDAddressB, cmpB is CoMPare to B, bcs is Branch if Carry bit Set, bne is Branch if Not Equal to zero

http://www.ele.uri.edu/Courses/ele205/6811-Instructions/index.html

so just for example (but i'll probably screw it up)



E2B6 F6 1D 28 @3 ldaB L1D28 ; the B register now contains whatever is in address @ 1D28
E2B9 F1 24 8F cmpB L248F ; compare B to memory address @ 248F (sets the condition register)
E2BC 25 0E bcs @6 ; if carry was set (meaning B was >= 248F) jump 14 bytes ahead
E2BE F6 1D 29 ldaB L1D29 ; B = address @ 1D29; but also sets the 'if zero' register
E2C1 26 04 bne @4 ; if B != 0, then jump 4 bytes ahead
E2C3 86 02 ldaA #$02 ; the A register now contains 0x02 (a static value)


so in c that would be like (pretending stuff like L1D28 is #define'd memory, which it is, ram is stored in all the low bytes):



char A,B;
B = L1D28;
if(B >= L248F) {
goto //fourteen_bytes_ahead;
};
B = L1D29;
if(B != 0) goto //four_bytes_ahead;
A = 0x02;


and obviously once you've jumped, A and B still equal whatever they did when they left, there's no actual blocks of code, braces, or 'scope of variables'...

[fbody_Brian]

http://www.ele.uri.edu/Courses/ele205/6811-Instructions/index.html

so just for example (but i'll probably screw it up)



E2B6 F6 1D 28 @3 ldaB L1D28 ; the B register now contains whatever is in address @ 1D28
E2B9 F1 24 8F cmpB L248F ; compare B to memory address @ 248F (sets the condition register)
E2BC 25 0E bcs @6 ; if carry was set (meaning B was >= 248F) jump 14 bytes ahead
E2BE F6 1D 29 ldaB L1D29 ; B = address @ 1D29; but also sets the 'if zero' register
E2C1 26 04 bne @4 ; if B != 0, then jump 4 bytes ahead
E2C3 86 02 ldaA #$02 ; the A register now contains 0x02 (a static value)


.

That doesn't actually look too bad.

[steveo]

no it doesnt, because it's motorola code! it's easy

and if you learn it you can...... write raw code for early 1990s macs! im sure there's tons of job prospects for that.........

[kur4o]

Hi to all.

I am trying to dissasemble some ee bins with IDA pro. The problem is I don`t know for sure what type of processor is used and how much is the ram.
It is 6811 series but there is 50+ different variations. Also where in the bin is the entry point.
Any input will be appreciated.

I found some similarities betwwen the l32 v6 bins and the ee code.
That way i discovered some tables described in the v6 xdf are in the same configuration in the ee code.

28A4-29C4 /3-2 BASE DC/
28C5-29D5 /3-2 DC TEMP COMP/
29D6-28E6 /UNKNOWN ADDED AT EE/
289A /3-2 TEMP CORRECT FLAG, 3-2 A/C COMP FLAG/
289B /MIN 3-2 DC/
289C /MAX 3-2 DC/
289D /3-2 DC WHEN SHIFTER IN 1ST/
289E /3-2 DC WITH LOST VSS SIGNAL/
28A3 /A/C ON 3-2 MOD TO DC/

As described in the v6 xdf.
Credits go to the author of this xdf.
This still need to be verified but whatever they do in v6, they do the same in the ee, because they are mapped identicaly.

Caibration part number is located at
E20-E23 , converted from hex to decimal.

[steveo]

it's a 68hc11, any revision of 68hc11 will do in IDA i think? (not using ida right now)

so you're looking into some auto trans stuff? awesome; that's the one part in EE im not interested in looking at (my only ee car is a manual), but could definitely use some fresh info

i'd be really interested in anything else you find.

i dont have the disassembly in front of me, but i think i remember that 0x2000 is the entry point? (or something simple like that)

[fbody_Brian]

More auto trans stuff would be great!

[RobertISaar]

the 6811s used in the 94-95 LT1 PCM are both 68HC11F1 models.

L32? that would be the 93-95 F-body 3.4, which i released a pretty significant XDF for already, perhaps i never defined those tables?

[steveo]

hmm never actually looked at that 3.4 xdf, i'll have to check 'er out

[kur4o]

Thanks for the input.
This is how the software is organized.

Both flash chips code are very similar and capable of operating indipendently.
So it`s good idea to be dissasembled separately.


First 64k of Bin or split1

0000-0400 looks like some defaullt values loaded in the ram./exactly how much ram the processor has/
0400-1000 empty space with some random data bytes
1000-2000 not sure what it is.again some random data.
2000-3B03 all this is tables and caibration data
3B04-3C3D Code instructions
EC3E-3F10 Messages for flashing purposes
3F11-EED1 Code instructions
EED1-FFD6 some data likely connected with serial communication /not sure about that, definitely not calibration data/
FFD6-FFFF not sure


second 64k of bin or split2

0000-0400 looks like some defaullt values loaded in the ram./exactly how much ram the processor has/
0400-1000 empty space with some random data bytes
1000-2000 not sure what it is.again some random data.
2000-2E07 all this is tables and caibration data
2E07-2E93 Code instructions
2E93-3266 Messages for flashing purposes
3266-7FED Code instructions
7F3D-8328 some data likely connected with serial communication /not sure about that, definitely not calibration data/
8328-FF9F Empty
FF9F-FFFF not sure


split1 data and code for transmission, diagnostic, serial communiction, sensor inputs.
split2 data and code for spark and fuel calculations

there is built in 486 bytes eeprom in each processor
Probably Vin and Cal id encoded there


Now I am trying to find how the hardware part is structured and working.
Without that there is no way i can understand the software part.
There is
3 68hc11 processors on board
-2 c94r - 68hc11f1
-1 d84g - ?
there is
2 that look like custom delco processors
-66285
One more that looks like processor
-ncr 129170

something that looks like memory chips in 28-plcc pakage
-delco 64606
-delco 27474
-ncr 144436


I tried that entry point but it didn`t worked
Here is a file from ida with auto settings.
I am still far from reading it but learning fast.
Does it look correctly dissasembled.

I am thinking of adding nitro spark retard switch.
There is existing circuit in the pcm that takes signal from Ebcm for spark retard request.
Typical value for that pin is B+ /pin is red 23 if someone is interested in testing/
So the signal must be b+ or ground, still to find out.
I need help finding the traction control tables associated with that hardware signal, so there is no hidden suprises.

That v6 xdf is the best cracked code i`ve seen so far.
robertisaar i see your the author so big greetings to you.
I hope some day we crack the EE code that far.

[EagleMark]

I think the best way to crack code on $EE or any... is to chip in and buy Robert the car and get him out of the V6! :laugh:

Great work guys! :thumbsup:

[steveo]

I am thinking of adding nitro spark retard switch.
There is existing circuit in the pcm that takes signal from Ebcm for spark retard request.
Typical value for that pin is B+ /pin is red 23 if someone is interested in testing/
So the signal must be b+ or ground, still to find out.
I need help finding the traction control tables associated with that hardware signal, so there is no hidden suprises.

That v6 xdf is the best cracked code i`ve seen so far.
robertisaar i see your the author so big greetings to you.
I hope some day we crack the EE code that far.

im trying too, we can share whatever we find. nice to have someone else that wants more out of it

i assume you're already playing ball with the EE XDF that i work on (in my sig) so you have table definitions for all the "known" stuff?

it's getting quite a bit more complete than it was, just based on pulling everything i could find, and from some help from guys like robert especially on the o2 config stuff, which was a very important step forward (CL instability has always been a problem in EE)

traction control is pretty straightforward signalling from what i know, i do know of someone else that used it for timing retard on spray, i know it was functional. but i think there must be more configuration, i think each timing retard request from the BCM subtracts a fixed amount of timing up to the limit in the max retard vs rpm table (which is known). perhaps there is a constant for the amount retarded per request.

i actually use the traction control timing retard, without the ASR motor, i have it working pretty well. would love more config.

would you be interested in contributing your findings to the XDF that i already maintain, or are you planning on making your own?

[steveo]

I think the best way to crack code on $EE or any... is to chip in and buy Robert the car and get him out of the V6! :laugh:

Great work guys! :thumbsup:

actually the best way would be to steal ALL of roberts ecms in the middle of the night, and leave him with a half a dozen EE ecms, and some connectors.. maybe a few opti wheels.. i bet we'd end up with nAstLT1 pretty quick. anyone got a ski mask?

[RobertISaar]

i already have a handful of the connectors it uses from the P66 V6 PCM(i would only be missing i think the red connector since the V6 uses the black, blue and clear already)).... nAstLT1 sounds neat though. if one were to have a decent idea of how the E-side works, it really wouldn't be that difficult to patch in all of the engine-related stuff i've done for nAst1, especially since i believe i've released commented assembly of everything i've done so far. if i'm remembering correctly, with as much free space is on the E-side, SO MUCH STUFF could be added. you could even throw in a small JPG/GIF/PNG in the empty space just for fun. or ASCII art.

i have an unusual amount of love for the V6 stuff though. i really don't know how much of it would translate to the LT1.

[steveo]

that's where I want to go with it, but time is the issue, mostly time to learn and test

[EagleMark]

...nAstLT1...Nice! :thumbsup:

[kur4o]

I am sorry for the late input.

But here is what i found out so far.
I mapped all the undefined data in the bin, next step is to find out what is used for.

Still to find out where is the non linear sensors calibration data. aldl messages tables.


Transmission tables in v6 l32 and v8 lt1 are very similar and i managed to find some more tables based on v6 xdf, again credits go to robertisaar


After many hours contemplating how the hardware is working i made a big discovery
E stands for engine or engine side of controller
T stands for transmission or transmission side of controller

T side is controlling trasmission, also process all the inputs from engine sensors/except maf/ including o2 sensors and is controlling aldl communication.
After processing the sensor inputs it send the info to e- side either via spi/serial peripheral interface/ bus or with direct connection with the e side processor.

E Side is controlling spark output and injectors firing
There is some third motorola processor with d84g mask code which is most likely dedicated with the maf signal calculations.
I am still trying to identify the d84g


Steveo i will be glad to contribute to the xdf you are already building and will be happy if you put all the findings in it, which is very comprehensive already.

[fbody_Brian]

Hey Steve, Just wondering what's up with the version numbering on your xdf, you went from 2.6 to 1.7, was that intentional?

[steveo]

haha did i?

that's just like me. it shouldnt have been on 2.x in the first place.

i think im going to just use a revision control system in the future

it's worth it to just pull this link once in a while to make sure it's up to date: http://resfilter.net/files/carstuff/EEX/EEX_XDF_CURRENT.zip

[steveo]

also sorry for the lack of updates lately, i never release without testing nearly every new feature and revision, but i've flashed my ecm too many times now, im going to hold off till i get a spare to keep going with it.

my disassembly is going kinda slow too, havent' had a lot of free time lately, glad someone else is doing a bit of work too!

lets find some new stuff soon

[fbody_Brian]

also sorry for the lack of updates lately, i never release without testing nearly every new feature and revision, but i've flashed my ecm too many times now, im going to hold off till i get a spare to keep going with it.

my disassembly is going kinda slow too, havent' had a lot of free time lately, glad someone else is doing a bit of work too!

lets find some new stuff soonI'm happy there's any work being done on it at all!
I completely understand about the no free time, that's the one reason I haven't dug into this yet. I have absolutely no time to spare. My band is currently practicing 2x a week, gigging weekends, full time job, 2 young kids, repairing and building effects pedals for friends, keeping the cars running.......it never ends. I guess eventually I'll just have to make some time. :)

[steveo]

..repairing and building effects pedals for friends..

that's right up my alley too

seriously i work in a seasonal business (powersports/boating) so im really burned out spring/summer, and i usually take on my heavy projects in the fall and winter

[beestoys]

Steve
I'll be beck in town soon I could run some tests if you want. Just give me a heads up on what your looking for> I'll see about scoring a different computer. Thinking it may be as cheap as the pumps we got.

[steveo]

damn well let me know if you come across any!

[Professwrx]

New here. I used to own a few firebirds, my brother has a 94 TA. I'm investigating his rom in IDA and found this thread.

Has anybody made any logical hacks for these? Is there any empty space in the rom? What about ram?
i have hacked my WRX and am building a virtual flex fuel code and antilag for the turbos. Thought it would be fun to see if there's room to add some turbo logic.

anyway, looking forward to dissecting it and seeing how much more defined it has gotten in the last few years.

[steveo]

there's plenty of empty rom space, a few fairly continuous sections that could be used for extra code or tables.

there's this old hack that i've been basing a lot of my findings on, and there's another guy here working on a fresh start with IDA and finding lots of stuff.

http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=3477&d=1357956073

unfortunately im pretty slow with disassembly, and there are lots of parts of EE that aren't understood yet...

[Faceman]

I am also interested in understanding the $EE code and had a look into the bin just with a text editor. There was some speculation about what T and E side means. i would say:
Time side and Event side, because there is reference in the bin:

first half of bin:
ERASING FLASH ON TIME SIDE.
PROGRAMMING FLASH ON TIME SIDE.

second half of bin:
PROGRAMMING FLASH ON EVENT SIDE.
ERASE VPP HI ERROR - EVENT SIDE.

But maybe it also correlates somehow to Engine and Transmission side.

Does anybody already know if the CPU memory is somehow mapped to the bin? I am asking because e.g. the VIN is in the bin, but I cannot imagine it is possible to change it by just changing it in the bin and flashing it into the car. I can imagine parts of the bin are not really written or used by the code, but come from CPU ROM.

And maybe a stupid question (sorry, don't have much knowledge yet): does the PCM have two or one 68k CPU? I am asking because the two sides seem to be so important.

[kur4o]

I am not sure but the Vin Cal id and some info is stored at the processor eeprom or some other memory chip on the board.

Actually it is two separate computers inside connected with spi interface with separate processors and memory chips.
The board that controls engine operation has two cpus. Possibly one is for maf calculations only.
T-side controls transmission and make BLM calculations and diagnostics.
E-side calculates spark, air and fuel.
T-side and e-side are flashed separately and it is possible to flash just one side, but no software I know has that feature.
Ram is mapped in the memory chip form $0000 to $2000

[Faceman]

Thanks for that info. Was the schematics of the two boards already reverse engineered ? Maybe there are even chips holding data that are not mapped to the BIN file. It also would be very interesting to know how the data looks like in the flash chip (or chips?) if read out externally. Is it possible that VIN and other stuff is stored in the CCM / BCM and retrieved from there during read procedure? Or maybe the PCM holds a copy.

[RobertISaar]

VIN is stored in the EEPROM that is internal to at least one of the 6811F1 processors. the 93-95 P66 V6 is the same way. a couple of other items(calibration part number is one) are also stored in there with the P66 V6 application, but I imagine the LT1 code does the same.

[lionelhutz]

I have changed the VIN before, but I haven't seen it as part of the bin file. I've always had to be connected to the PCM to change it.

[Faceman]

A Tunercat bin file contains the VIN (ASCII encoded, so easy human readable) at $e24
But I've never tried to change it and check if it really gets written into the PCM.

[RobertISaar]

the VIN is located there in the BIN due to the way the upload program works.... it just dumps values sequentially from a starting address to the end of the PROM, including the processor's EEPROM range.

[Faceman]

Robert do you know the address ranges in the bin, that are used for which "data source" in the PCM? Is there data in PCM that cannot be accessed via ALDL? And how about writing? Which parts of bin can be edited and are really written somewhere in the PCM?

[lionelhutz]

Tunercat doesn't give the option of checking or changing the VIN when editing the bin. There must be a reason it has to be done live while connected to the PCM. It's not possible to change part of the flash memory chip so the VIN changing routine is writing somewhere else besides into the bin file. I'm betting the "real" VIN is stored in a processor like Robert mentioned.

The bin contains the data in both of the flash chips. When I fixed my bricked PCM I split the bin and put 1/2 into each flash chip. So, reading the bin doesn't pull from other memory locations in the PCM like you keep asking about.

[RobertISaar]

i'll have to dig around to see if I kept any notes, but what I was able to find, it was due to the processors being normal 68HC11F1 models... if you step through the beginning of the program when the power-on RESET procedure is done, you can find out where the processor allocates its on-board memory. knowing that the F1 has 512 bytes of EEPROM built-in and seeing that the VIN is stored a little above $E00, it's a good assumption that the EEPROM is mapped from $E00 to $FFF. so, anything you see in the BINs that is in that range, it was pulled from the processor's EEPROM during the read operation. you can read EEPROM as if it were normal RAM or a register, but writing to it is another thing. the pink book explains that process fairly well.

[Faceman]

Maybe the config register is also somewhere in the BIN? The config register tells where the EEPROM is mapped to. Per default from the data sheet it's $FE00–$FFFF.

It is for sure, that the bin contains other data, not only data from flash chips, because there is data that changes with every readout, so obviously RAM is included. That also means, there is memory on the flash chips, that is never used, because it is not addressed by the MCU (can imagine a multiplexing mechanism, where external RAM is explicitely addressed, but I am not yet so deep into the data sheet).

The problem is, that this MCU is so highly flexible... and I do not know, how GM configures it. I am about buying such a PCM and I will disassemble it.

[Faceman]

Ok, I just had a look at the CONFIG register, that seems to be contained in the BIN file at $103F, the value is $0B, means 00001011b, so EE0 to EE3 are all zero, so EEPROM location is:
$0E00 – $0FFF
see http://cache.freescale.com/files/microcontrollers/doc/data_sheet/MC68HC11F1.pdf table 4-4

So Robert you are absolutely right !

[RobertISaar]

that sounds about how I'm remembering it. I guess with the BIN pulling the registers, you don't need to step through the beginning of the code instruction by instruction to see what eventually got written. certain registers will change, but something like EEPROM location certainly wouldn't.

as far as the mux'd addressing, I've never had a 94-95 LT1 PCM opened up, so I can't say for certain. the 93-95 3100 PCM uses dual 32KB flash PROMs and doesn't have to try to overlap PROM space with any external addresses the way that the LT1 PCM has to with its 64KB PROMs.

[Faceman]

Now I have a quite good understanding of how it all works theoretically in this type of PCM. That special config register is in EEPROM, so I think it does never change. GM decided how they want to use the memory map and it's fixed. What I still couldn't figure out is, what happens during startup of the engine, what type of reset is used, where does the MCU get it's starting address from for executing code and so on.
If I am lucky I will get a PCM soon for playing...

[RobertISaar]

you may want to grab a copy of the 68HC11 programmer's reference manual.... it leaves out very little of the operation of a 68HC11F1 since it was written based on an earlier model, but I have managed to get ahold of an F1 supplement that has shed some light on things that were skipped in the original reference manual.

[Faceman]

Could you send me a soft copy of the programmers reference manual or can I download it?

Did anybody already read out the bootloader ROM of the two MCUs? Is there any interesting stuff inside? Of course not for operating the vehicle under normal conditions, but maybe other things?

[steveo]

I'm so close to a working flash tool right now; it reads but I bricked my spare ecm so work is on hold until I socket it.

[RobertISaar]

Could you send me a soft copy of the programmers reference manual or can I download it?

Did anybody already read out the bootloader ROM of the two MCUs? Is there any interesting stuff inside? Of course not for operating the vehicle under normal conditions, but maybe other things?

I'm certain I've uploaded them to the forum before, but I can't remember where.... either way, i'll see if I can attach them to this post.

barely squeaked under the size limit for a ZIP archive, should have both PDFs in it.


I'm so close to a working flash tool right now; it reads but I bricked my spare ecm so work is on hold until I socket it.

I forget, were you working on LT1 only or was the V6 PCM included in that project as well?

[steveo]

I forget, were you working on LT1 only or was the V6 PCM included in that project as well?

i don't have V6 stuff to test with, so we're probably talking LT1 only.. but i betcha they're the same command set?

[RobertISaar]

similar, at least. simpler to implement, if I had to guess, since you don't have to try and communicate with only E or T and pass it information over SPI(since I think that is how the 94-95 LT1 PCM is setup, one side doesn't have a physical connection to the ALDL port? I might be thinking of the 93-95 northstar unit too.....). address E with $F4 and address T with $E4, I might have those reversed, though.

they run 32KB PROMs(mapped from 8000-FFFF as one would expect), the madtuner(and I assume tunercat as well) flashing software stacks them into a single 64KB BIN with the E-side first. I don't have many specifics beyond that, when I was working with him, madtuner figured out the upload/download routines while I dealt with finding stuff in the calibrations.

[steveo]

similar, at least. simpler to implement, if I had to guess, since you don't have to try and communicate with only E or T and pass it information over SPI(since I think that is how the 94-95 LT1 PCM is setup, one side doesn't have a physical connection to the ALDL port? I might be thinking of the 93-95 northstar unit too.....)

nah they're both pinned out to the aldl port for serial comms. it doesn't pass over SPI for flash routine.

each board has nearly identical code for flashing. you just flash one board, then flash the other.

the e-side is actually really talkative if you know where to poke at it, most of the diagnostic routines are there but many are nerfed or simply unfinished. i've only tested some flash routine related junk, mostly mode 0x06 and mode 0x0D.

[RobertISaar]

http://i.imgur.com/j5fcMno.png (http://i.imgur.com/j5fcMno.png)

here's a screenshot of what you get with the P66 V6 when using the madtuner software, the VIN tab is the same for the 94-95 LT1, but you see a couple of different things here. with the P66 V6 all of this data can be grabbed with a single mode 1, message 4 request to the T-side. message 4 is almost entirely pulled from the T-side's processor's EEPROM.

E04-E13 stores the serial number
E20-E23 stores the calibration ID(which unless you/someone else modifies it, it appears to be the last factory calibration that was flashed to the PCM, good to know if you forget to pull the original BIN)
E24-E34 stores the VIN

that's all of the EEPROM data in that tab, the E-side and T-side part numbers are pulled from the E-side and T-side calibrations in the flash area from 8000-8003.

I imagine the LT1 stuff will be setup in a similar fashion.

[jthompson122183]

Transient fuel routine related tables


;--------------------------------------
; Fuel Boiling Time vs. Coolant vs. Map
; table size 5 x 15
;
; TBL = 100 * SEC'S
;--------------------------------------
ORG $26F2 ;

FCB 0 ; Min COOL Val
FCB 0 ; Min MAP Value
FCB 5 ; COL'S/ROW

;--------------------------------------------------
; -40 Deg C COOL
;
; Seconds Kpa MAP
;--------------------------------------------------
FCB 69 ; 0.690 20.0
FCB 86 ; 0.860 40.0
FCB 92 ; 0.920 60.0
FCB 98 ; 0.980 80.0
FCB 104 ; 1.040 100.0


;---------------------------------------
; Fuel on Cylinder (http://ls1tech.com/forums/#) Wall Multiplier Vs Cylinder time/DegK
; Table Lines = 255
;
; TBL = 256 * Mult
;---------------------------------------
ORG $2740

L2740 FCB 255 ; 0.996
L2741 FCB 255 ; 0.996
L2742 FCB 254 ; 0.992
L2743 FCB 253 ; 0.988


;--------------------------------------------------
; Puddle Limit vs. Filtered Airflow
; Table Lines = 17
;
; Table = .4096 * mgrams
;--------------------------------------------------
ORG $2893

mgrams gms/sec Airflow
;----------------------------------
L2893 FCB 255 ; 623 0.0
L2894 FCB 255 ; 623 8.0
L2895 FCB 255 ; 623 16.0
L2896 FCB 255 ; 623 24.0
L2897 FCB 255 ; 623 32.0


Found that here http://ls1tech.com/forums/pcm-diagnostics-tuning/173656-can-someone-explain-direct-relationship-stft-has-ltft.html

also found this for explanation http://www.hptuners.com/forum/showthread.php?44912-Transient-Fuel-Tips-Tricks-and-Info-A-how-to-guide
and this also http://www.hptuners.com/forum/showthread.php?10872-Let-s-discuss-Transient-Fuel

[kur4o]

These are some really interesting links.
Thanks for digging them out.
Interesting, who is the author of this dissasembly.

[steveo]

that's awesome; those tables were always a huge question in my mind!

i'll put them in my next XDF for sure

[fbody_Brian]

These are some really interesting links.
Thanks for digging them out.
Interesting, who is the author of this dissasembly.
Very interesting! Wish there were more posts like that out there. Funny how it's a post from 04 yet it seems like new info.
It's so exciting to know that there's still more discoveries and tuning capabilities for the old LT1.

[steveo]

Very interesting! Wish there were more posts like that out there. Funny how it's a post from 04 yet it seems like new info.
It's so exciting to know that there's still more discoveries and tuning capabilities for the old LT1.

that's the thing, the hackers ripped $ ee apart in the late 90s, then abandoned it because the ls1 is tastier and profitable. it makes it interesting. there arent many new discoveries.

I wish all work done back then was in the public domain, but we do have some scraps like this to pick at while guys like ku4ro and robert and me try to reinvent the wheel.

I do know that the o2 timing stuff that robert discovered is fairly fresh, though. ive analyzed a lot of bins and never really seen it modified.

[jthompson122183]

is there any of these tables in EE? this is from a 97 z28

980198029803

[kur4o]

There are some similar, for the spark at startup and iat corr.
Do you need something specific to dig out?

[jthompson122183]

The iat and startup spark corrections would be awesome.

[jthompson122183]

A tuner also mentioned that there was a maf vs coolant correction table, and a maf vs barometric pres table.

[steveo]

A tuner also mentioned that there was a maf vs coolant correction table, and a maf vs barometric pres table.

i've never seen any evidence of that

[jthompson122183]

There are some similar, for the spark at startup and iat corr.
Do you need something specific to dig out?
think ive found some of the startup spark stuff

124d6 Startup Spark Retard Vs Coolant Temp
124e7 Startup Spark Retard Decay Delay Vs Coolant Temp

theres something at 124b4 and 124c3 but havent figured them out yet
im still trying to find the mat modifier stuff and the iat spark correction stuff. any help?

[kur4o]

Here is almost complete map for eside calibration. You can have a look and test what you like.
I made a quick check and no iat spark corr, I might try to make a patch and add one if you have interest to test.

[fbody_Brian]

Here is almost complete map for eside calibration. You can have a look and test what you like. I made a quick check and no iat spark corr, I might try to make a patch and add one if you have interest to test. POSS SPARK PE ADDER VS x12 low reference ... could this be the mystery additional timing at WOT? very interested in that.

[steveo]

me too. i've always wanted a patch for stricter timing @ WOT. it always seems a bit sketchy.

[Smitherik]

Hello everyone Iam running a Chevy 350 tbi but how do I change the Tunning from the factory chip

[steveo]

Hello everyone Iam running a Chevy 350 tbi but how do I change the Tunning from the factory chip

however you do it, certainly don't do it with any of the info in this particular thread

how about google 'tbi tuning' to start with?

[jthompson122183]

Here is almost complete map for eside calibration. You can have a look and test what you like.
I made a quick check and no iat spark corr, I might try to make a patch and add one if you have interest to test.

i didnt see much in there for iat spark either. But i did happen to notice that 12dbc looks like its Inverse MAT Term Lookup Delta Mult. Vs. Airflow (0.007813 * X)?

i took that esidemap.txt and added it to eex and ive included a bunch of other stuff in it also:) its over 700kb!!
Any chance you could share your tside map? It would be awesome to have more autotrans stuff:)
Also would you happen to know where this ieee checksum is located? 9896
Ive up the bin for that also. Thanks for your work on the EE platform.

[kur4o]

Adding that stuff to the xdf is so much work. Thanks for the time, now it will be much easier to trace calibration changes.
The checksum is at 2015 on both sides. I have no idea what this ieee is for, I suppose its the whole bin checksum or something similar.

Here is the tside part. Use only well definied stuff, because there is a lot more work to do on that side.

The most interesting part is the mode 2 transmission mode( I reffer it also as manual mode). It is activated by external switch just like performance mode and has it`s own transmission tables.

[jthompson122183]

Adding that stuff to the xdf is so much work. Thanks for the time, now it will be much easier to trace calibration changes.
The checksum is at 2015 on both sides. I have no idea what this ieee is for, I suppose its the whole bin checksum or something similar.

Here is the tside part. Use only well definied stuff, because there is a lot more work to do on that side.

The most interesting part is the mode 2 transmission mode( I reffer it also as manual mode). It is activated by external switch just like performance mode and has it`s own transmission tables.

HOLY SHIT! this is gonna be a huge xdf huge i tell ya! not for the week at heart!
ill email tunercat and see if i can get info on that ieee checksum.
what pin is manual mode on? i have the trans perform switch hooked up and love it, would like to try that manual mode sometime. gimme a few and ill have the t side added in to eex.xdf:happy:

[RobSS96dcm]

HOLY SHIT! this is gonna be a huge xdf huge i tell ya! not for the week at heart!
ill email tunercat and see if i can get info on that ieee checksum.
what pin is manual mode on? i have the trans perform switch hooked up and love it, would like to try that manual mode sometime. gimme a few and ill have the t side added in to eex.xdf:happy:

That mode 2 or manual mode might be something thats in there for diagnostic purposes. With My tech 2 I have the ability to do upshifts, downshifts, tcc lock and unlock, etc.

[kur4o]

pin c31 (clear) activate
pin b10(black) lamp control


Wiring and activation is the same as performance mode.

Switch is momentary, lamp is grounded.
I don`t know what will happen if you activate both modes at the same time, so use cautiously.

[jthompson122183]

Got a good bit of the t-side added in. Still alot left to do. i also cleaned up and better organized. Enjoy!DISCLAIMER! USE AT YOUR OWN RISK! VERY SUPER ALPHA!I call it EEXTRA check here http://www.gearhead-efi.com/Fuel-Injection/showthread.php?2890-EE-dissection&p=63764&viewfull=1#post63764

[steveo]

that's great to have; thanks for doing all that work! you should break all my category stuff and name all the other tables like that too; with their address prefixes, right now a lot of that stuff is redundant.

i'll read through it a bit more when i have time, but have you noticed any tables or constants that would be useful for the everyday tuner that aren't defined in EEX yet?

[sherlock9c1]

Can I request a units changed in the automatic transmisssion section? The "Maximum Line Pressure" of 90psi needs to NOT be in psi - it's really "max line pressure threshold" - the number at which the force motor is at full extension. Unless I'm not understanding that parameter at all...

[lionelhutz]

Can I request a units changed in the automatic transmisssion section? The "Maximum Line Pressure" of 90psi needs to NOT be in psi - it's really "max line pressure threshold" - the number at which the force motor is at full extension. Unless I'm not understanding that parameter at all...

A bunch of tables would really need re-naming, since psi is used a number of times. The pressure tables are all factors, not psi. My understanding is that they are combined to a final factor that is divided by the max pressure threshold and then looked-up in the force motor tables to get the force motor current. But then, maybe the max pressure is the cut-off threshold for the factor?

[sherlock9c1]

Yes, cut-off threshold is a good way to put it.

In real life, a healthy 4L60E with zero% TPS runs around 65-70psi just idling in P, N or D. It spikes to 100-150psi in Reverse. Add throttle and line pressure goes up, to a max of around 230psi near the top of 1st gear. As a guy who has spent a lot of time inside 4L60Es and months driving around with pressure gauges ziptied to the windshield wipers watching what's happening, having the "psi" labels in the tuning programs just drives me crazy.

[lionelhutz]

I've read before that increasing that parameter would actually cause the line pressure to drop, which would seem to indicate it's more than just a cut-off or limit on the pressure factor.

[jthompson122183]

that's great to have; thanks for doing all that work! you should break all my category stuff and name all the other tables like that too; with their address prefixes, right now a lot of that stuff is redundant.

i'll read through it a bit more when i have time, but have you noticed any tables or constants that would be useful for the everyday tuner that aren't defined in EEX yet?
Yes i would agree alot of it will be never used or useful to a tuner, but just to compare calibrations is awesome! My car is a auto, i know you don't want hear this but it would be nice have more auto stuff added in. Something that ive notice is when comparing a factory Y F B/D body that 26d3 mult to cal %tps & 12020 multiplier for tps voltage to get %TPS is different between all three. i changed mine to the vette and seemed to notice just a little bit better throttle response. I had someone test 12046 poss spark adder from reference pulse to min rpm spark and closed tps spark tables and it took away the added spark at wot for them.

while still on the xdf topic your V3.6, when changing the values in the spark correction vs temp they dont save they revert back to was originally loaded. Also its the same with maf table 3 7888hz & 8016hz values. This is also the same for the xdf i posted as it started off as V2.8

[steveo]

Yes i would agree alot of it will be never used or useful to a tuner, but just to compare calibrations is awesome!

i agree completely. having two seperate xdf files is awesome for this purpose.


My car is a auto, i know you don't want hear this but it would be nice have more auto stuff added in. Something that ive notice is when comparing a factory Y F B/D body that 26d3 mult to cal %tps & 12020 multiplier for tps voltage to get %TPS is different between all three. i changed mine to the vette and seemed to notice just a little bit better throttle response. I had someone test 12046 poss spark adder from reference pulse to min rpm spark and closed tps spark tables and it took away the added spark at wot for them.

i'd love more details on that, especially that mystery table at 12046.

another thing missing which im sure has been found is iac to throttle follower (assuming it exists, logs seem to indicate that it does)

auto stuff? of course i want to improve that. i just dont want to do any of the work or learn about automatic transmissions, i have enough on my plate. i'd love for someone to help update my automatic trans stuff, documentation etc, but it has to be of the same quality as the rest of the XDF (i.e. all well named, categorized, noobified and commented/documented). also just need to be sure that average tuners would benefit from the parameters added.


while still on the xdf topic your V3.6, when changing the values in the spark correction vs temp they dont save they revert back to was originally loaded. Also its the same with maf table 3 7888hz & 8016hz values. This is also the same for the xdf i posted as it started off as V2.8

yeah the coolant temp thing is some horrifying tunerpro bug when you're using a bias value. notice updating the RAW value works, and updating a non-negative value works fine too at least most of the time... i should delete the bias cross-reference from the XDF and just build it into the calc. i can't imagine any tuner would ever change that bias anyway. the only reason i put it in there is in case someone is reading a tune-by-mail tune and they've used it to jack spark advance up across the board or something, at least they'd know about it.

that is, unless someone can tell me why tunerpro acts this way so i can fix it

the maf thing is news to me, but you're right. i haven't run a maf in a while so i haven't really played around with it. i can't seem to figure out WHY it's happening, though. i'd appreciate any thoughts?

tunerpro has some really bizarre bugs sometimes.

[steveo]

would you perhaps like to take a stab at the automatic transmission stuff against v3.6 and let me know how it goes? i'd love some help in that area...

[sherlock9c1]

Is there any torque management stuff in the 8051? Specifically, the ability to cut timing during heavy load shifts. My guess is no, because that would have saved a LOT of 4L60Es during the mid 1990s!

[steveo]

just throwing it out there;

may not be hard to hack in simple retard-as-you-shift logic to $ee as there's an almost-never-used timing retard routine just sitting there: traction control! (spark retard vs rpm with a hard request input)

it obviously pulls traction control requests from a hardware address as requests happen. you could change that address to something else and insert a simple line of code as a shift is happening to increment that address to produce a 'traction control request' or whatever (and count that back down to zero earlier on in the loop so you have decay)

or as a hardware hack with no patch...maybe... you could produce a request electrically by making a simple module that tickles the traction control request line when a shift solenoid is actuated.

if per-rpm retard control isn't enough, you could probably re-purpose the traction control routine even further by making the table vs. map instead of vs. rpm, and then you'd have load-dependent retard?

none of this is very elegant but why not..

[jthompson122183]

another thing missing which im sure has been found is iac to throttle follower (assuming it exists, logs seem to indicate that it does)
.


is this what your talking about?



10043 10042

[steveo]

nah

iac seems to advance based soley on TPS (even when idle to vss follower is zeroed out)

maybe it's calculated instead of being a table

[jthompson122183]

What does AD stand for or mean? Like AD tps or AD Map. Adaptive? Is it what the pcm uses for default values if the sensor goes bad? I see this alot in these map.txt.

[kur4o]

In this case AD=analog to digital (conversion).
Or the tps, map voltage converted to raw digital data without any processing;
for examle 0 - 5 volts range equals to $00 - $ff range in digital counts

[Rocko350]

126dc in the eextra.xdf file looks like it could be the coded rpm limit in the 8051. I need to dig around in the code to see if it is a math limit or a hard limit. If it "works out" maybe the tables themselves could be stretched for more rpm. I dont think anything but a new opti would handle that. And maybe not many current new ones could.

though maybe 1240a may be the airflow mass adder for an rpm delta measurement. It is different in each y/b/f calibrations.

12848 and 126f5 might be related to open loop/closed loop. I have seen other coolant temp to fuel calcs in other ecms with this sort of spread

Just Thinking out loud. I have a year or more to read up on disassembly just to be a real part of this convo.

Awesome work guys. Just awesome


Chris

[sherlock9c1]

How hard would it be to adjust the MAP scale values to accomodate 2-bar or 3-bar MAP sensors? could these tables be enlarged in size so you don't lose resolution?

[kur4o]

It will be really hard because map scalars are everywhere, and if you plug 3 bar map ad voltage at 100kpa will be 1/3 of 5v I guess which will be 1.67 volts and from 0 to 1.67 you get very low resolution, unless you drive boost or near boost all the time, reolution will suffer.
Much easier will be to add second 2 or 3 bar map sensor on one of the free ad channels, make new 3d table with bpw adder or whatever you like. That way you won`t lose resolution off boost and can get full control on extra fuel needed. Also you can map spark retarder that use the second map sensor.
Of course we will need full graph with AD counts vs boost on the new map sensor so it can be dialed in proper way and a volunteer with engine to sacrifice, Initial test may be done with variable potentiometer hooked on the ad channel on NA engine

[steveo]

imo, that sounds like a really complicated project without a huge amount of real-world gain for tuning boost

since full resolution in 5 map steps is totally unnecessary for a boosted engine, hell, even an n/a engine would get by on 10 map steps, and tripling table sizes would require a few thousand bytes...

why don't we work on adding 8 columns of MAP, making 24 map column spark and VE tables?

that'll give you a bit more resolution to play with in boost, with a 2 bar, you'd get 12 columns in boost, 12 columns out of boost. isn't too shabby, compared to the 8 you get now..

i'd be willing to make a second EEX XDF just for boost so it would be usable..

[fbody_Brian]

So I got around to testing that pe spark adder. It's set at 5 be default. I had timing set to max at 33° wot, and was seeing 38° in my logs. After setting it to 0, I'm now seeing 33° as I would have expected. So put me down as one more person who has got rid of the mysterious added PE timing by changing this parameter.

[steveo]

i'd love to know how it works. a pe spark adder is nice. we should use it properly instead of nerfing it

[Terminal_Crazy]

So I got around to testing that pe spark adder. It's set at 5 be default. I had timing set to max at 33° wot, and was seeing 38° in my logs. After setting it to 0, I'm now seeing 33° as I would have expected. So put me down as one more person who has got rid of the mysterious added PE timing by changing this parameter.

Where is that stored ? I couldn't see any reference to it in the xdf file.

Mitch

[Terminal_Crazy]

Has anyone got any info/writeups on the knock sensor circuit code ?

This might actually be better in a different thread.

I've been suffering from knock for a while with my motor. I'm 99.9% certain it's false but couldn't find much info on handling it.
Anyways.
I spent yesterday researching what i could find out re desensitizing it.
Trawling the web did'nt reveal much evidence other than delete it or switch it off.
I eventually found an image of a circuit to mod the signal from PCM to knock sensor using a couple of resistors, "The Knock Knocker" by Mike Chaney.

Today I've been playing with an adjustable version & recorded some results which look promising.
I can variably reduce the knock counts from ~500 down to ~60 every time i tap the alternatorby adjusting the pot.

I've no evidence yet & further things to investigate but presume I'm cutting the signal off earlier by reducing this level.
I'll post results some time soon.


What actually prompted me to post though was that i couldn't recall seeing anywhere the knock counts were referenced.
I then wondered what the PCM's strategy was as to using the Low Octane Table.
I can see 3 x vs Knock sensor voltages listed but no other references.



Cheers
Mitch

[fbody_Brian]

i'd love to know how it works. a pe spark adder is nice. we should use it properly instead of nerfing it
I agree!, but for the moment it's nice to be able to just zero it out so I know that the timing is what I expect it to be.

Where is that stored ? I couldn't see any reference to it in the xdf file.

Mitch
I'll have to look later, think it's in misc, or experimental. Don't have access to the computer right now.

[steveo]

Has anyone got any info/writeups on the knock sensor circuit code ?

This might actually be better in a different thread.

I've been suffering from knock for a while with my motor. I'm 99.9% certain it's false but couldn't find much info on handling it.
Anyways.
I spent yesterday researching what i could find out re desensitizing it.
Trawling the web did'nt reveal much evidence other than delete it or switch it off.
I eventually found an image of a circuit to mod the signal from PCM to knock sensor using a couple of resistors, "The Knock Knocker" by Mike Chaney.

Today I've been playing with an adjustable version & recorded some results which look promising.
I can variably reduce the knock counts from ~500 down to ~60 every time i tap the alternatorby adjusting the pot.

I've no evidence yet & further things to investigate but presume I'm cutting the signal off earlier by reducing this level.
I'll post results some time soon.


What actually prompted me to post though was that i couldn't recall seeing anywhere the knock counts were referenced.
I then wondered what the PCM's strategy was as to using the Low Octane Table.
I can see 3 x vs Knock sensor voltages listed but no other references.



Cheers
Mitch

there's no real knock sensor circuit code that deals with the analog side, the knock module does all that in hardware, then just sends a 'knock' signal on or off to the ecm and the ecm increments the knock counter.

i usually just nerf the stupid knock sensor in the range it's giving me trouble. a conservative timing table with a conservative AFR doesn't really need a knock sensor anyway.

reducing the effective number of knock counts per event may not give you great results, it will probably just slow the attack rate, which you can do in software.

[steveo]

Where is that stored ? I couldn't see any reference to it in the xdf file.

Mitch

experimental > unknown spark adder
(in the latest version)

stock is 5, affects PE only, reccommend 0

[steveo]

i looked at the code and it definitely looks like it's in power enrichment and per rpm but i can't really figure how it scales. maybe kur4o has looked into it a bit more.

[Terminal_Crazy]

there's no real knock sensor circuit code that deals with the analog side, the knock module does all that in hardware, then just sends a 'knock' signal on or off to the ecm and the ecm increments the knock counter.

reducing the effective number of knock counts per event may not give you great results, it will probably just slow the attack rate, which you can do in software.

After having another play today with the PCM settings I think the overall effect is similar but the PCM has finer control across the range.
I now understand it better.

Thanks.
Mitch

[kur4o]

Actually the spark adder is double word value. Stock value is $0510.
It is not PE related. It is always applied. I guess it is scaled vs low refence pulse word_a1.
I need to get some logging of a1 values to fully understand how it is used.

From my observation the spark adder is step added with increasing rpm up to 5 degrees on stock log file.[$0510 value][Can someone confirm changing 05 to 02 results only 2 degree SA spread]. It is more obvious in full throttle because you have fixed SA to compare, but my assumption is it is added all the time if conditions met.
The main reason for this could be SA compensation for optical sensor signal deviations at higher rpm.

[steveo]

16 bits is a hell of a range for a spark adder. i wonder why they did that.


my assumption is it is added all the time if conditions met.

those conditions are what we need to look into



5F93 15 34 08 @134 bclr l_0034_tts_1, #%00001000
5F96 57 @135 asrB
5F97 F7 01 4A staB L014A
5F9A DE A1 ldX l_00a1_ref_period_12x
5F9C FC 20 46 ldD L2046 ; $0510 (1296)
5F9F 02 idiv ; integer 1296/00a1 -> X
5FA0 8F xgDX ; -> D
5FA1 04 lsrD ; / 2
5FA2 C9 00 adcB #$00
5FA4 F7 01 4C staB L014C
5FA7 F6 01 4A ldaB L014A
5FAA FB 01 4C addB L014C
5FAD F7 01 49 staB l_0149_tts_GP6ESPKO
5FB0 12 01 20 22 brset L0001, #%00100000, @138
5FB4 86 5A ldaA #$5A
5FB6 10 sBA
5FB7 16 tAB
5FB8 B6 15 F6 ldaA L15F6
5FBB 01 nop
5FBC FE 15 F6 ldX L15F6
5FBF 3A aBX
5FC0 FF 14 54 stX L1454
5FC3 12 23 80 04 brset L0023, #%10000000, @136
5FC7 86 03 ldaA #$03
5FC9 20 02 jr @137

[jthompson122183]

ive asked around in several places and found that the 2046 double byte on eside is "est system lag time"
This is what i got from tc when asked:

"Hi Jonathon,

This is the EST system time lag and is meant to correct for the latency in the spark system. It is a fixed value in usec:

lag (usec.) = N x 0.08477

Of course since the time lag is a fix time value the correction in terms of degrees will depend on RPM.

Best regards,
TC
"

[jthompson122183]

i was curious about the 21cd table on the tside and got the first pic as a response
i'm interested in the three bytes before each one of these tables shown in the second and third pic, there is 4 tables in this area also.
Are these the points in which the pcm can say the o2 sensor can swing back the other direction "Flyback Voltage" like the 4th picture
the first of the three bytes has something to do with tps, is this min or max tps that the pcm uses to determine when to use the next two bytes?




10717 10718 10719 10720

[kur4o]

i was curious about the 21cd table on the tside and got the first pic as a response
i'm interested in the three bytes before each one of these tables shown in the second and third pic, there is 4 tables in this area also.
Are these the points in which the pcm can say the o2 sensor can swing back the other direction "Flyback Voltage" like the 4th picture
the first of the three bytes has something to do with tps, is this min or max tps that the pcm uses to determine when to use the next two bytes?




10717107181071910720

Tps byte is used when the timer of the table expires.
It is a min threshold to completely skip table lookup.

Table skip is set once per ignition cycle when timer expires and tps threshold is reached.

Other two bytes are used to skip table lookup when ad 02 voltage is outside of the two bytes range.

[jthompson122183]

per tc : t-side

$33A7 is the shift pressure offset vs. TPS - 2nd Gear - Performance Mode
$33B8 is the shift pressure offset vs. TPS - 3rd Gear - Performance Mode
$33C9 is the shift pressure offset vs. TPS - 4th Gear - Performance Mode

$34A6 is the upshift delay vs. TPS 1->2 shift
$34B7 is the upshift delay vs. TPS 2->3 shift
$34C8 is the upshift delay vs. TPS 3->4 shift

$3440 is the ramp 2 pressure delta vs. TPS 1->2 shift
$3451 is the ramp 2 pressure delta vs. TPS 2->3 shift
$3462 is the ramp 2 pressure delta vs. TPS 3->4 shift

$3473 is the pressure ramp 2 time vs. TPS 1->2 shift
$3484 is the pressure ramp 2 time vs. TPS 2->3 shift
$3495 is the pressure ramp 2 time vs. TPS 3->4 shift

[jthompson122183]

per tc :t-side 2224 sets the number of consecutive failures or passes required to log a passed or failed coolant system closed loop temperature diagnostic test.
t-side 2225 is the first of a group of O2 sensor response diagnostic parameters

[jthompson122183]

per tc: t-side
$33DA is the start of the 1-2, 2-3, 3-4 Pressure ramp delay time (secs) vs TPS
$340D starts the 1-2, 2-3, 3-4 Pressure delta Ramp vs TPS

[jthompson122183]

What is the equation for grams/cylinder? the location of cylinder mass air correction vs tps is at $24C3 eside. The 96-97 also has this table

11032

[steveo]

thats an interesting correction factor, can you confirm its effect and ill add it to my xdf? looks like a good place to tune idle/decel fuel for maf cars.

[jthompson122183]

thats an interesting correction factor, can you confirm its effect and ill add it to my xdf? looks like a good place to tune idle/decel fuel for maf cars.



11035

[steveo]

"invalid attachment specified"

[jthompson122183]

"invalid attachment specified"


11036

[jthompson122183]

now just need the equation i have been searching hacs and nothing is standing out

[steveo]

ill work on it

[jthompson122183]

maybe x/69.975 for the cylinder mass air correction vs tps at $24C3 eside ? wonder if @kur4o has any idea.

[jthompson122183]

also $240a eside is gm/cyl filter coefficient low-med-high Map vs low-med-high RPM

[jthompson122183]

from the 96-97 vdf

[jthompson122183]

using 0.015625

[jthompson122183]

using 0.014275

[jthompson122183]

here's the answer from tc *0.015625 also gives the same numbers

[Terminal_Crazy]

Excellent stuff, love reading things like this.
Where and how would this be used ?

Mitch

[steveo]

a maf adder per tps%, so if you could identify tps bound fueling changes, you could more effectively tune a maf based car than with just the maf table..

.. also probably a great place to tune idle/decel?

can anyone confirm it actually works?

[kur4o]

--2021 is delta tps threshold [if lower use ramp out, if higher use main calc]

--2413 is ramp out rate

--2414 is filter for substantial negative delta tps.

--24b4 is filter correction vs Coolant table used with baro correction at 26ba

24b4 result is multiplied with 26ba result,

the result is used as filter to 24c3 table

24c3 table is also used as threshold for burst knock tables

and 24c3 result could be described as % of calculated[predicted] delta airflow change due to delta tps transitions
and the result[filtered with coolant and baro corr] is always added[If positive delta change] or substracted[If negative delta change] to actual MAF value
______________________________
This is the other MAF filter

Still not clear what is does
RESERVED:240A fcb $20 :1st below 51kp and 900 rpm
RESERVED:240B fcb $1B ; 2nd below 51kp rpm between 900-2000
RESERVED:240C fcb $1A ; 3rd below 51kp rpm above 2000
RESERVED:240D fcb $18 ; 4th map between 51kp and 80kp, rpm below 900
RESERVED:240E fcb $1A ; 5th map between 51kp and 80kp, rpm between 900-2000
RESERVED:240F fcb $1B ; 6th map between 51kp and 80kp, rpm above 2000
RESERVED:2410 fcb $18 ; 7th map above 80 kp, rpm below 900
RESERVED:2411 fcb $14 ; 8th map above 80 kp, rpm between 900-2000
RESERVED:2412 fcb $17 ; 9th map above 80 kp, rpm above 2000

2406 lower map threshold
2407 upper map threshold
2408 lower rpm threshold
2409 upper rpm threshold

[jthompson122183]

Here is my latest eextra.xdf lots of stuff have been named and reworked. Enjoy!
Credits are in the "==Read==" section
Steveo, i've added the byte numbers in front of what has been already been known and did some other tweaks.

http://www.gearhead-efi.com/Fuel-Injection/showthread.php?6260-94-95-EE-xdf-(EEXTRA)

[steveo]

awesome, i'll check it out sometime soon

[jthompson122183]

i made a thread for eextra

http://www.gearhead-efi.com/Fuel-Injection/showthread.php?6260-94-95-EE-xdf-(EEXTRA)

[kur4o]

Here it is pump shot adder, cures completely nasty lean tip-in.
It only works on maf tuned cars.
It is a multiplier to maf value and is always added. So you may define your own boundaries to get a fine tune.
Also it is applied after maf calculations for aldl stream and correction won`t be visible in the data stream.

I added up to 50% on some cells for testing purpose and it lowered tip-in afr by 3 points.



RESERVED:240A fcb $20 ; some adder table to MAF
RESERVED:240A ; 1st below 51kp and 900 rpm
RESERVED:240B fcb $1B ; 2nd below 51kp rpm between 900-2000
RESERVED:240C fcb $1A ; 3rd below 51kp rpm above 2000
RESERVED:240D fcb $18 ; 4th map between 51kp and 80kp, rpm below 900
RESERVED:240E fcb $1A ; 5th map between 51kp and 80kp, rpm between 900-2000
RESERVED:240F fcb $1B ; 6th map between 51kp and 80kp, rpm above 2000
RESERVED:2410 fcb $18 ; 7th map above 80 kp, rpm below 900
RESERVED:2411 fcb $14 ; 8th map above 80 kp, rpm between 900-2000
RESERVED:2412 fcb $17 ; 9th map above 80 kp, rpm above 2000


rpm and map bounderies are defined by
2406 low map bundary
2407 high map boundary
2408 low rpm bondary
2409 high rpm boundary

[johnny_b]

could this be used to reduce the need for burst knock? given the lt1 was always thought to be lacking an AE routine?