Hacking the DataStream

[gregs78cam]

So you want to be able to datalog, or view some seemingly insignificant piece of data coming from the ECM, or you need to see something that GM should have put in the datastream, and left out. Here ya go. I learned how to do this by looking through 93V8S10's AWESOME P4 PCM files and making small tweaks.

First you have to figure out if the ECM actually stores that data you want in the RAM. And you have to find this out by searching through the hac. In this case we are going to try to add 'Injector PulseWidth" to the '7747 datastream. A suitable address in the .bin could not really found, so we are going to get it directly from the register.


LBC00 EQU $BC00 ; DRP COUNT

LBC0E EQU $BC0E ; SYNC BPW PWM
LBC14 EQU $BC14 ; ASYNC BPW PWM

LBC3C EQU $BC3C ; PWM


So the next step is to decide which piece of data in the data stream we want to replace with the INJ PW. In this case PROM ID makes the most sense because it too is a 2byte value, and is hardly used.


; ALDL XMIT TABLE OR ADDRESSE'S
; 127747 ECM
;
; 5.7L TBI L05 C/K 87,91 TRUCKS
;
; DATA PIN: Read data on PIN "E" of ALDL Connector
;
; BAUD RATE: 160 Baud
; Open - 20 Bytes
; 10k - 20 Bytes
; Shorted - 20 Bytes
;
;---------------------------------------------
ORG $04E7 ;
LD4E7 FDB $D002 ; 1. EPROM ID LSB
LD4E9 FDB $D003 ; 2. EPROM ID MSB
;---------------------------------
LD4EB FDB $00FD ; 3. CURRENT IAC POSIT, (0-255)
; N = COUNTS

What we are going to do is change the .bin at L04E7 from $D002 to $BC0E and L04E9 from $D003 to $BC0F from above. Only we are going to do it with a constant so we can change it easily, without having to use the hexeditor.

So we make a XDF parameter as follows........
http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=1806&d=1330651088

At this point we have just told the computer to look at a different address for the data to send out in the datastream.


Next step is to make a ADX parameter to view the data.
http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=1807&d=1330651557

We make the packet offset 0x02, because I guess that is the spot in the datastream that should have what used to be PROM ID, should now be INJ PW.


Almost forgot, make the conversion as shown........
http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=1808&d=1330651758


Now someone make a log and tell me it worked.......Please:innocent2:.

[EagleMark]

Sweet! Soon as I get a chance to do this I'll be logging! :jfj:

[93V8S10]

Nice! GearHead EFI needs a "like" button! :thumbsup:

[EagleMark]

Working but not reading right? Does it have to do with 2 bytes and we are only using one? LSB and MSB?

[gregs78cam]

It shouldn't be because of that.... We set the source data size to 16bit. Might try the LSB first check mark, but shouldn't need it. I think. Did you set the size in XDF parameter to 2byte, 16bit? Maybe Output type to 'Integer'? If you have data coming out that is half the battle.

[gregs78cam]

Nice! GearHead EFI needs a "like" button! :thumbsup:

Thanks, but I am just following in your foot steps.

[EagleMark]

It shouldn't be because of that.... We set the source data size to 16bit. Might try the LSB first check mark, but shouldn't need it. I think. Did you set the size in XDF parameter to 2byte, 16bit? Maybe Output type to 'Integer'? If you have data coming out that is half the battle.Yup 2byte 16bit. but theres some conversion stuff on tab on bottom of XDF maybe?

0x4E7 and D002 to 0052

I'll try the integrater and stuff, I'm emulating in driveway so can get wireless internet...

[gregs78cam]

but theres some conversion stuff on tab on bottom of XDF maybe?
.

nope that is just for the XDF parameter display.

zip me a log and files and I will take a look at it.

EDIT: Found it! Change packet offset to 0x00

[EagleMark]

Changed packet offset to 0x00 and seems steady but numbers are wrong? Data log attatched.

Also checked in hex editor at line 04E and it is changing 8th and 9th set of hex? But XDF was 0x4E7

[EagleMark]

Also changed back to D002 and still get same reading in adx? I think the hex address is off. It is changing 8th and 9th hex in that line?

[gregs78cam]

OK, as a test go into hex editor and change the data at 0x4E9 to 0053 also. I will update the thread pics if this works.

[EagleMark]

here's the XDF, adx and bin set to D002

[gregs78cam]

I forgot we are actually dealing with two bytes in the datastream code. Check the first pic. OR try these.......

[EagleMark]

OK did 0x4E7 and it changed 8th 9th 10th 11th hex from D0 02 D0 03 to 00 52 0053 so that looks right?

BUT SOMETHING IS WRONG ON ADX SIDE NOW WE HAVE msb lsb 32 bit change in bi.

I looked at ALDL file and for Prom ID it says:


2 PROMID (MSB)
3 PROMID (LSB) PROMID = (MSB)*256 + (LSB)

The 2 in adx file would be 0x01 and the 3 would be 0x02 because they are 1 off, 1 is 0x00.

Getting a reading in adx but it's 500.00ish and when I rev up goes down to 15.00ish

[gregs78cam]

HHMMMM. Ok, The hac I was looking at had Prom ID as 1 & 2, now you're saying 2 & 3. Try changing the packet offset back to 0x01. The data should come out of the ALDL as a 16bit value, then we just need to convert it properly.

[EagleMark]

Yes that's the bin hac. what I showed above is the ALDL the way it is recived and I have never done this. We need Rober Saar!!! Here is what TunerPro says about 2 bytes MSB LSB for ADX file.


Packet Offset (H | D) - This is the zero-based byte number within the packet that this value is
associated with. The data at this offset is used for the conversion. If the item
is 8 bits (1 byte) in size, it will contain only this byte. If it is 16 bits (2
bytes) in size, it will this byte number plus the byte after (MSB, LSB). To
input data in hexadecimal, use the left side text field. For decimal, use the
right side text field.


Data Source Size - This specifies the number of bits (and bytes) that will be used to
calculate the displayed value. 8 bits equals 1 byte, and 16 (bytes=wrong in directions and should be bits) equals 2 bytes
(MSB, LSB), and 32 bits is 4 bytes (MMSB, MSB, LSB LLSB).

[RobertISaar]

it's too bad all of the $42 hacks start at D000, meaning all of the RAM address are cutoff...

however:

http://www.thirdgen.org/techboard/diy-prom/128321-sa-bpw-info-winaldl.html

confirm:
0052 is the BPW MSB
0053 is the BPW LSB

so what i would do:

change D4E7(will show as 04E7 in the TP hex editor) to 00 52
change D4E9(04E9) to 00 53

^assuming those aren't reversed anyways

then change a working $42 ADX and outright modify the PROM ID value instead of making a new one. just call it BPW, we'll deal with scaling later if it's correct. don't do any of that LSB first stuff since it's not necessary since we are able to modify the stream. save the BIN so the checksum updates and test.



that's what i would do.

[EagleMark]

Problem is there is no Prom ID in the ADX and I don't know how to set up MSB LSB?

TunerPro directions say:

If the item is 8 bits (1 byte) in size, it will contain only this byte. If it is
16 bits (2 bytes) in size, it will this byte number plus the byte after (MSB,
LSB). I know how to do 8 bit 1 byte "0x01" but how do you get 2 in that box with below set to 16 bit? If I enter "0x01 0x02" it comes out to 4097 in text box?

[gregs78cam]

it's too bad all of the $42 hacks start at D000, meaning all of the RAM address are cutoff...

however:

http://www.thirdgen.org/techboard/diy-prom/128321-sa-bpw-info-winaldl.html

confirm:
0052 is the BPW MSB
0053 is the BPW LSB

so what i would do:

change D4E7(will show as 04E7 in the TP hex editor) to 00 52
change D4E9(04E9) to 00 53

^assuming those aren't reversed anyways

then change a working $42 ADX and outright modify the PROM ID value instead of making a new one. just call it BPW, we'll deal with scaling later if it's correct. don't do any of that LSB first stuff since it's not necessary since we are able to modify the stream. save the BIN so the checksum updates and test.



that's what i would do.

From the hac I was looking at...
LSB @ 0052
MSB @ 0053

We are logging the data from one address into an 8bit value, and data from the other to the following 8bit value. Even if these are reversed, isn't it easy to fix in the ADX, just checkmark LSB first? OR does it have to be logged that way?

I have another ADX that shows PromID as Packet 0x01, don't know if it works right though.
http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=1794&d=1330573222

[gregs78cam]

Problem is there is no Prom ID in the ADX and I don't know how to set up MSB LSB?


I know how to do 8 bit 1 byte "0x01" but how do you get 2 in that box with below set to 16 bit? If I enter "0x01 0x02" it comes out to 4097 in text box?

From my experience it simply takes the following packet and puts it into a 16bit with the first packet.

[RobertISaar]

this is why i tend to stay away from C3 stuff....

a testbench would be a wonderful tool here, assuming someone had one setup for a 7747.

but i would attempt to put them in the correct order in the BIN and not mess with the ADX unless necessary.

mark, a link to the ADX you're using?

[EagleMark]

My test bench is in the middle or a wire harness build, but I do have a 7747 in my Suburban with AutoProm hooked up in driveway. We got the change in XDF correct as you noted and it checks out in bin in hex, we get data but it is not correct, don't now how to do MSB LSB 16 bit data. The ADX never had a Prom ID.

ADX attached...

[EagleMark]

From my experience it simply takes the following packet and puts it into a 16bit with the first packet.I am going to try that right now...

[RobertISaar]

from the looks of it, you have the correct settings in the ADX, Mark, so it's all in the BIN now.

[EagleMark]

That did not work with ADX change..

It looks like it's changing 8 9 10 11 in hex and it should be changing 7 8 9 10 . I'm going to try and change the hex and see if it logs as Robert said it looks OK. If it works we will see why we are 1 off with XDF thingy...

[gregs78cam]

That did not work with ADX change..

It looks like it's changing 8 9 10 11 in hex and it should be changing 7 8 9 10 . I'm going to try and change the hex and see if it logs as Robert said it looks OK. If it works we will see why we are 1 off with XDF thingy...

The .bin address is correct. It should be and is changing:
L04E7 00
L04E8 52
L04E9 00
L04EA 53

You could try swapping the 52 and 53, but that should just do the same thing as setting the 'LSB First' checkmark in the ADX.


I found this at the end of the hac I have been using. There are some more references to BPW, so maybe I just picked the wrong address to pull data from. We can try them one at a time, and see what we get.
You can try:
L04E7 L04E8 L04E9 L04EA
$BC $0E $BC $0F
or
$BC $3C $BC $3D





; ASDZ ALGO, 12/03/93, WAS
; REV 06/06/95, WAS
;
; 127747 ECM
;
; OBJECT FILE: AKSM
; DISASSEMBLED FOR THE MC6803
; BY THE CAMS DISASSEMBLER
; 12-09-1992
;---------------------------------------------
L0000 EQU $0000 ; STATUS WD
L0001 EQU $0001 ; STATUS WD
L0002 EQU $0002 ; STATUS WD
L0003 EQU $0003 ; STATUS WD
; b4 = FUEL DECEL C/O
;
L0004 EQU $0004 ; STATUS WD
L0005 EQU $0005 ; STATUS WD
L0006 EQU $0006 ; STATUS WD
L0007 EQU $0007 ; STATUS WD
L0008 EQU $0008 ; STATUS WD
L0009 EQU $0009 ; STATUS WD
L000B EQU $000B ; STATUS WD
L000D EQU $000D ; STATUS WD

L000E EQU $000E ; MAWF1 (DISPLAY)

L000F EQU $000F ; STATUS WD

L0010 EQU $0010 ; TMR
L0012 EQU $0012 ; AFR STATUS WD
L001C EQU $001C ; RPM/25
L001F EQU $001F ; RPM/12.5

L0020 EQU $0020 ; RPM/12.5
L0021 EQU $0021 ; COOLANT
L0025 EQU $0025 ; COOLANT, VDC

L0026 EQU $0026 ; S/D MAP
L002B EQU $002B ; TRANSIENT MAP TMR
L002E EQU $002E ; MAP
L002F EQU $002F ; FILT MAP

L0031 EQU $0031 ; VACUUM
L0032 EQU $0032 ; DIFF MAP
L0034 EQU $0034 ; MPH/1
L0036 EQU $0036 ; MPH VAL

L003E EQU $003E ; o2 VDC, (A/D)
L003F EQU $003F ; FILT o2 VAL

L0043 EQU $0043 ; ASYNC INJ VAL

L0048 EQU $0048 ; TPS, VDC
L0049 EQU $0049 ; TPS
L004A EQU $004A
L004B EQU $004B ; ACCEL ENRICH FILTERED TPS
L004C EQU $004C
L004D EQU $004D ; FILTERED TPS
L004F EQU $004F ; MIN TPS VAL
L0050 EQU $0050 ; TPS ERR TMR
L0051 EQU $0051

L0052 EQU $0052 ; BPW, MSB
L0053 EQU $0053 ; BPW, LSB

L0054 EQU $0054 ; COLD OP'S o2
L0055 EQU $0055 ; o2 SENSOR VOLTAGE BIAS
L0056 EQU $0056 ; Slow o2 ERROR
L0057 EQU $0057 ; ASYNC INJ MULT
L0058 EQU $0058 ; PORP DURATION, SEC'S
L0070 EQU $0070 ; STATUS WD
L007F EQU $007F ; AIR FLOW FOR EGR

L0096 EQU $0096 ; BPW, ASYN
L0098 EQU $0098
L0099 EQU $0099 ; PUMP SHOT LK UP
L009A EQU $009A
L009B EQU $009B ; TRANS FUEL CALC INTERVEL TMR
L009C EQU $009C ;
L009D EQU $009D
L009E EQU $009E ; DECEL FUEL MULT
L009F EQU $009F ; BETWEEN DECEL FUEL C/0 TIMER
L00A0 EQU $00A0 ; POST DECEL C/O TMR
L00A1 EQU $00A1 ; DECEL FUEL C/O TMR
L00A2 EQU $00A2 ; BLM
L00A3 EQU $00A3 ; BLM, BIN
L00A4 EQU $00A4 ; INTIGRATOR, BIN
L00A5 EQU $00A5 ; OPN LP AFR
L00A6 EQU $00A6
L00A7 EQU $00A7 ; EGR CORRECTION
L00A9 EQU $00A9 ; VE LK UP RESULT

L00AA EQU $00AA

L00AB EQU $00AB ; TEMP BPW, (SYNC)
L00AD EQU $00AD ; TEMP BPW, (ASYNC)

L00AF EQU $00AF ; INTEGRATOR DELAY TMR
L00B0 EQU $00B0 ; INTEGRATOR DELAY
L00B1 EQU $00B1
L00B2 EQU $00B2
L00B4 EQU $00B4 ; IDLE AFR TMR
L00B5 EQU $00B5 ; AFR
L00B6 EQU $00B6 ; AFR
L00B8 EQU $00B8 ; BLK LEARN TMR
L00B9 EQU $00B9 ; INTEGRATOR DELAY TMR
L00BA EQU $00BA ; ALDL CTR
L00BB EQU $00BB ; PE ON DELAY TMR
L00BC EQU $00BC ; PORP FACTORED AIR FLOW
L00BD EQU $00BD ; OLD FILT o2 VAL
L00BE EQU $00BE ; AIR FLOW, (gms/sec)
L00BF EQU $00BF ; PORP DURATION TMR
L00DE EQU $00DE ; STATUS WD
L00DF EQU $00DF
L00E3 EQU $00E3 ; START UP COOL
L00E5 EQU $00E5 ; AFR


L0457 EQU $0457 ; FOR HEADS UP USE
L0458 EQU $0458 ; FOR HEADS UP USE


L5800 EQU $5800 ; HEADS UP


LBC00 EQU $BC00 ; DRP COUNT

LBC0E EQU $BC0E ; SYNC BPW PWM
LBC14 EQU $BC14 ; ASYNC BPW PWM

LBC3C EQU $BC3C ; PWM



LE008 EQU $E008 ; CPU HOOK
LE531 EQU $E531

LFA59 EQU $FA59 ; FIRMWARE
LFB12 EQU $FB12 ; LAG FILTER ROUTINE
LFB36 EQU $FB36 ; 2d LK UP
LFB40 EQU $FB40 ; 2D LK UP W/LINE CNT IN HDR
LFB45 EQU $FB45 ; 2d LK UP
LFB49 EQU $FB49 ; 2d look up routine
LFB67 EQU $FB67 ; 3D LU ?
LFB92 EQU $FB92
LFBB9 EQU $FBB9
LFBCE EQU $FBCE
LFBDB EQU $FBDB ; READ A/D
LFCD8 EQU $FCD8
LFD18 EQU $FD18

LFD39 EQU $FD39

LFDBD EQU $FDBD
LFDCB EQU $FDCB
LFDDA EQU $FDDA
LFF66 EQU $FF66
LFF80 EQU $FF80
LFFFF EQU $FFFF

[EagleMark]

I think we got the right ones and it's working. But I think the conversion is wrong. Numbers go up with load and down on decel. But there no where near %

[RobertISaar]

I think we got the right ones and it's working. But I think the conversion is wrong. Numbers go up with load and down on decel. But there no where near %

for now, it's just BPW, but it sounds like it's working.

if the BPW is correct, then a injector DC value can be created.

[EagleMark]

if the BPW is correct, then a injector DC value can be created.Is that the conversion? It does go up with load, down with decel and is steady with other data. But I thought in the end it was a value of up to 100%?

Anyway sweet job Greg! :thumbsup: Thanks for the help Robert! :thumbsup: I learned a lot tonight and because of you guys think I could do this again for Spark and Hiway AFR I wanted to add. At least Greg can get his first post write up correct!
We all learned from you guys! :jfj:

[gregs78cam]

No problem, It should be reading in milliseconds. Idle should be around .5-.75 millisconds, and WOT should be somewhere around 3-4ms or maybe as high as 5-6ms depending on RPM.

So it is actually working properly? Or does the data still jump around?

[EagleMark]

It's as steady as 160 baud data! :laugh:

Here's the ADX, XDF, bin and data log. I took out conversion and played with it a little. Bottom line is numbers go up with load and down on decel. I put it in drive foot on brake and gave gas, watch vacuum drop and BPW goes up, vacuum goes up and BPW goes down.

[gregs78cam]

That data still does not look quite right. To go from .061 to .004 and back up, that just isn't right. I need to come by on Friday before work and try a few more things. At idle, with 160 baud it should stay almost rock steady at something, it is changing by a factor of 10 when it shouldn't be. I need to do some work with this.

[EagleMark]

If you look it changes at idle as idle changes, 25 or 50 RPM. Remember how slow 160 baud is? Your used to smooth 8192 baud data... 160 is IIRC every 1.2 seconds...

[gregs78cam]

Yea I get the 160baud, "tune by braille", but the values don't seem anywhere close to what they should be. Do me a favor and tomorrow, try changing the XDF values to "BC0EBC0F", using the attached ADX make a log then change them to "BC3CBC3D" and make another log. Then post back.

[EagleMark]

Do you a favor? Ha! I thought you were doing me a favor?

OK but you really got me going on some things I have wanted to learn to do! Now it's midnight and I have been reading hacs all night and figured out how to FINALLY get real TPS Percent into data stream! :happy:

May have figured how to Hiway AFR?

Don't think there's a way to get actual spark advance... I'm going to bed...

[gregs78cam]

Now it's midnight and I have been reading hacs all night and figured out how to FINALLY get real TPS Percent into data stream! http://www.gearhead-efi.com/Fuel-Injection/images/smilies/happy.gif

That's easy, in fact in think this is how I wanted to make it happen and you insisted on using an equation to get %.:laugh:

TPS VDC --> TPS%, L04F5: 0048 -->0049

Spark Advance shouldn't be hard but it takes up two packets in the datastream, I don't know where to find HIway AFR. The only problem with '7747 is not much datastream to use. Now we could replace the error codes with 3 more datapoints.

This '7747 ADX stuff makes my head hurt. Not much data and nowhere to put what we do have.

[EagleMark]

The C3 160 baud is very limiting compared to newer stuff, that's for sure!

I wanted an ADX anyone could use to get percent without a hac and you helped me achieve that! :happy:

Now you helped me (and everyone) learn how to do these hacs with a hard one that needed 2 outputs and 2 inputs and we achieved that! :happy:

Then I had enough knowledge to reverse it and found more things to do like a hac for TPS %! :happy:

But I want to keep TPS voltage because it is used for min air/idle settings and I found another part of data stream not used to receive data in ADX file, like Prom ID was not there, and worthless for the most part if it were there. It is " 18 OLDPA3 N = COUNTS" I don't even know what it is, but am going to use it for TPS% so I have both TPS% and TPS voltage. :happy:

So to summerize... :wtg:

[RobertISaar]

OLDPA3 (decoded: previous pulse accumulator #3) = knock counter.

and you can always use just the LSB of the spark advance, it's a signed(or is it 2's compliment?) value, so unless you get near firing ATDC often, i wouldn't think its an issue. when bit 7 of the MSB is set, then the SA is displayed in ATDC, with FFFF being 0* or 0.39* ATDC and lower numbers being even further after TDC.

and yeah, once you have control of the datastream, you'll wonder why GM put in some of the stuff that they did.




also, RBob would probably know the actual BPW location in a 7747, no?

[gregs78cam]

AAhhh. You mean here.


; b2 OF3 A/C 1 = A/C disabled
; b1 AIR DIVERT 1 = Solenoid engaged
; b0 AIR SWITCH 1 = Solenoid engaged
;
;---------------------------------
LD507 FDB $0073 ; 17. OLD PA3 KNOCK COUNTER
; N = COUNTs
;---------------------------------
LD509 FDB $00A3 ; 18. BLM, (BLM/1)
;
;---------------------------------

Can do that too.

[EagleMark]

OLDPA3 (decoded: previous pulse accumulator #3) = knock counter.

and you can always use just the LSB of the spark advance, it's a signed(or is it 2's compliment?) value, so unless you get near firing ATDC often, i wouldn't think its an issue. when bit 7 of the MSB is set, then the SA is displayed in ATDC, with FFFF being 0* or 0.39* ATDC and lower numbers being even further after TDC.

and yeah, once you have control of the datastream, you'll wonder why GM put in some of the stuff that they did.Thanks Robert I'll look into that when I work on this. Spark advance would be a good feature in ADX but with the XDF and ADX I set up data tracing so I actually know where spark is. It's not a requirment. Injector Duty Cycle/BPW Duty Cyle is not something I can data trace except back to VE to get an idea...



also, RBob would probably know the actual BPW location in a 7747, no?His knowledge is amazing. He probably knows location from memory... if we fail I'll ask and I'm sure he would help as always. But right now I'm learning so much I just want to run with it for awhile.

[EagleMark]

AAhhh. You mean here.


; b2 OF3 A/C 1 = A/C disabled
; b1 AIR DIVERT 1 = Solenoid engaged
; b0 AIR SWITCH 1 = Solenoid engaged
;
;---------------------------------
LD507 FDB $0073 ; 17. OLD PA3 KNOCK COUNTER
; N = COUNTs
;---------------------------------
LD509 FDB $00A3 ; 18. BLM, (BLM/1)
;
;---------------------------------

Can do that too.That's the one! See I am catching on! :jfj:

[EagleMark]

Yea I get the 160baud, "tune by braille", but the values don't seem anywhere close to what they should be. Do me a favor and tomorrow, try changing the XDF values to "BC0EBC0F", using the attached ADX make a log then change them to "BC3CBC3D" and make another log. Then post back.I'll try that today while running around. But what address? I don't see those at 0x4E7

[RobertISaar]

he wants you to try the Sync BPW registers directly.... i THINK that will work, but i'm not 100% certain. it works on P4, or at least i remember it working.

[EagleMark]

Ah! I see that earlier in thread. I forgot I don't need that address, I am changing data output address to send differant things!

[EagleMark]

TPS% hac worked first shot! :jfj: pretty darn close to the calculated value you did off TPS voltage!

OK Greg I did those tests. First I did some changes in my ADX as mentioned above... So I opened your adx and copied the Injector Pulse value over to mine, I am including it so you can check. But first test on both hex strings failed? Got 0 reading on first one and one reading on second one that never changed. Then I changed the Packet offset in ADX from 0x01 to 0x02 and they both worked. One well and the other not so well.

I had a lot of running around to do today and have not looked at them more than just to see they were working and clicking record and saving file. Still busy and will look at them later but posting them up in case you have time between now and then.

You mentioned you may be coming to town Friday, I'll be here all day as the kid has day off and we'll be working on his TBI conversion.

[gregs78cam]

NOW THAT LOOKS A LOT BETTER. BC0EBC0F looks like what we are looking for. The range is right, the way it follows TPS looks right. SWEET!!!:rockon: Only way to be sure would be to hook up a DMM to the injector line and verify milliseconds at idle. I will update first post.

[RobertISaar]

so you can directly read the hardware registers for the C3 datastream. neat.

[EagleMark]

NOW THAT LOOKS A LOT BETTER. BC0EBC0F looks like what we are looking for. The range is right, the way it follows TPS looks right. SWEET!!!:rockon: Only way to be sure would be to hook up a DMM to the injector line and verify milliseconds at idle. I will update first post.Alright! :rockon:

I updated the XDF and ADX file with this and the TPS% hac. What would be correct name for this? BPW Duty Cycle? Injector Pulsewidth?

[RobertISaar]

BCOE is sync BPW.

so i'd just call it BPW, since with 160 baud, you'll never be able to see async BPW.

[EagleMark]

What is the range on this BPW supposed to be? Looks like it's hitting 5.1xx IIRC. Is there any math formula to make this percent? Would be easier to read...

[RobertISaar]

i'm not the expert when it comes to TBI, but IIRC, the injectors fire with every reference pulse, with the injector pair alternating which one fires for a given pulse?

[gregs78cam]

It changes by RPM......


From RBob:

Static is at 100% or greater. The '747/'8063/'8746 ECMs fire an injector every time a plug fires. There are two injectors. They alternate on plugs firings.

Before I go too much further this is in synchronous mode. Sync mode is sync'd to plug firings. This is the most common mode. I have seen a few cals that are always in async mode, but never an f-body cal.

So for each revolution (V8) there are four plug firings. It takes two revolutions to fire all eight cylinders/plugs. Alternating injectors, that means each injector fires twice on each engine revolution.

At 4,000 RPM (revolutions per minute), divide by 60 for revolutions per second: 4000 / 60 = 66.67 revolutions per second. Invert this value for the time of each revolution (or frequency thereof): 1 / 66.67 = 0.015 seconds. Or, 15 milli-seconds (msec) per revolution.

With each injector firing twice each revolution we need to divide the amount of time in half: 15 msec / 2 = 7.5 msec.

This 7.5 msec is the amount of time an injector has before it is fired again (at 4,000 RPM). The higher the engine speed, the less time there is for an injector to deliver the required amount of fuel.

This is why it is important to keep an eye on the injector PW. Once the PW value exceeds that given amount of time, no more fuel can be added. The darn injector is on ALL of the time.

At this point the only thing that can be done is to increase the delivery of fuel. Bigger injectors and/or higher fuel pressure is required.

As another data point at 6,000 RPM a TBI injector is static once it hits 5.0 msec of on time. For best results TBI injectors shouldn't be open for more then 85% duty cycle. At 6K RPM this is 4.25 msec's.

RBob.

[EagleMark]

Like I could do the math for that? Let alone the x BPW * y RPM = then split into percent? :laugh:

[RobertISaar]

well, here is how it works with double-fire MPFI:

(X*y)/600

X and Y are RPM and BPW.

and with single fire MPFI:

(X*y)/1200

X/Y still RPM and BPW.

single fire fires the injectors once every 4 stroke cycle(so every other revolution), double fire does once every revolution.

[EagleMark]

OK how about another value of DC % and

X*Y/60000*100

x base pulse width
y RPM

?

[EagleMark]

and does this conversion for BPW do the same thing as the one you made Greg?

X * 0.015259 + 0.000000

[gregs78cam]

Some more good info, especially the Asynch stuff at the end.....

http://www.fullsizechevy.com/forum/general-discussion/performance/tbi-tuning-87-95-obd-i-ecm-pcm/350013-ve-limit-injector-size.html


The reference period to calculate duty cycle is the amount of time the injector can physically stay open in relation to its current opening duration. You can run the same pulsewidth on an injector, say 5 msec and the duty cycle will rise with RPM. Increase the pulsewidth and you increase fuel delivery, but fuel delivery also increases with rpm as the duty cycle increases. I will make two specific examples here to use. Keep in mind that TBI injectors fire alternately at each reference pulse, 2x per crank rotation each. There is an injector firing every reference pulse, but the alternate back and forth between left and right. You also want the injectors to run no more than 80-85% DC. With that knowledge we are first going to look at what is happening at 600 rpm, again at 1,800, 3,600, and finally 6,000 rpm. I am assuming an engine with a hot-rod nature and peak torque around 3,600 rpm and a 6K redline. It is easiest to look at it in terms of multiples of 6.

600rpm/60sec = 10 r.p.s. 1sec = 1000 msec. 10 r.p.s. is 1 revolution every 100 msec. During that 100 msec time period, you have to squeeze in two injector firings. That means there is 50 msec worth of time to fire the injector each time. At the engines normal idle speed/load you will see around 2 msec pulsewidth. At idle you are at roughly 4% duty cycle and 2 msec pulsewidth @ 600 rpm.

1,800rpm / 60sec = 30 rps (revolutions per second) or 60 fps (firings per second) = 1000/30 = 16.67 msec per firing, max. Your commanded pulsewidth will be around 3 msec at normal load. 3/16.67x100 = 17.99 or about 18% DC for 3 msec @ 1,800rpm

3,600rpm/60sec = 60 rps or 120 fps. 1000/120= 8.33 msec MAX. Your commanded fuel will likely be around 7 msec around peak torque 7/8.33 = 84% DC for 7 msec @ 3,600 rpm.

6,000 rpm/60 sec = 100 rps or 200fps 1000/200 = 5 msec MAX. Your pulsewidth will put you very static here, without a strong fuel delivery system. With the TBI firing stategy you either need to run large injectors or go asynch at high load. Asynch mode fires the injectors 85 times per second on BOTH injectors. This allows you to dump in A LOT more fuel from the same injectors. I am going to go ahead and run the math though. You will very likely need 5+ msec of pulsewidth here. Lets say 5.25 msec. 5.25/5 = 1.05*100 = 105% DC. Obviously once you have reached about 85-90% DC your injectors are static. To stay under 85% DC, you need to keep you pulsewidth under 4.25 msec @ 6,000 rpm.

Now finally here is why to go asynch @ WOT. Your injectors are firing at a fixed 85 hz or 85 times per second which is once every 12.5 msec. If you are firing once per 12.5 msec you are able to run 10.625 msec before you cross 85% DC. You are able to flow ALOT more fuel with one 10.625 msec firing than you are with two 4.25 msec firings totaling 8.5 msec! You are able to flow something around 20% more fuel through the same injectors in asynch mode.

Last edited by Fast305; 10-20-2008 at 01:04 PM.

[gregs78cam]

and does this conversion for BPW do the same thing as the one you made Greg?

X * 0.015259 + 0.000000

Yes .. X / 65.536 = X * 0.015259

If you want to make a gauge for Duty Cycle, look through the one in $0D or $0E and copy that one. :thumbsup:

[1project2many]

OLDPA3 (decoded: previous pulse accumulator #3) = knock counter.

and you can always use just the LSB of the spark advance, it's a signed(or is it 2's compliment?) value, so unless you get near firing ATDC often, i wouldn't think its an issue. when bit 7 of the MSB is set, then the SA is displayed in ATDC, with FFFF being 0* or 0.39* ATDC and lower numbers being even further after TDC.

and yeah, once you have control of the datastream, you'll wonder why GM put in some of the stuff that they did.
Datamaster for $58 displays timing based on LSB only. It works ok with a Dizzy cal but the DIS conversions require mental math to understand. I've always wished DM didn't shortcut this since the full 16 bit value is xmitted on the datastream.

PROM ID is for a service tech so prom identification didn't require ecm removal and partial disassembly. Some of you guys never got to experience the days when GM was releasing updates almost as fast as new cars. Any driveablility complaint was first addressed by checking for latest cal and installing if needed. If that didn't fix it, then diagnosis would actually be required.



What is the range on this BPW supposed to be? Looks like it's hitting 5.1xx IIRC. Is there any math formula to make this percent? Would be easier to read...

You shouldn't need much math. The ECM records the time between reference pulses in order to calculate RPM. Since synch mode injectors fire 1x per 2 REF pulses, the math is IDC%= IPW / (2 X REFPER). REFPER is available directly from the EST hardware as seen below but must be converted to seconds if IPW is in seconds.

D7FD: LDX LBC00 ; DRP COUNT, ECU HARDWARE

Unfortunately this is a label not an actual address. The address is probably $BC00 but maybe not. The way to tell is to xmit this address over the ALDL with no translation and compare it to calculated values based on the number of cylinders and the rpm. For an 8 cylinder engine, here are useful values for comparisons.




rpm counter counter time /
(hex) (decimal) pulse
500 07AE 1966 30ms
1000 03D7 983 15ms
1500 028F 655 10ms
2000 01EC 492 7.5ms
2500 0189 393 6ms
3000 0148 328 5ms
3500 0119 281 4.28ms
4000 00F6 246 3.75ms
4500 00DA 218 3.3ms
5000 00C5 197 3ms
5500 00B3 179 2.7ms


To make it really complete, try to make the ADX file monitor the asynch firing bit and switch off the IDC betwwen synch mode and asynch mode calcs appropriately.

[EagleMark]

Thanks Project!


Yes .. X / 65.536 = X * 0.015259

If you want to make a gauge for Duty Cycle, look through the one in $0D or $0E and copy that one. :thumbsup:
You didn't think I came up with those calculations did you? :laugh:

Your the only math skills I have! :thumbsup:

[EagleMark]

Well I got the Injector Duty Cycle in and looks to be working properly, I'll have to do some WOT High PRM testing. It's about 1% at idle and hit 29% at 85 kpa at 3000 rpm was the highest I had on only data log with BPW installed. By reading the info above posted by Greg from RBob and Fast355 if I double that to 6000 RPM and KPA was a little closer to 100 it's about right!

Also got a MPG history table in, copied mostly from $OD but needed some tweaks for $42. In looking at short data log I had from testing the original post of this thread it seemed quite accurate at cruising speeds around town at 15 to 18 and I do get 17.5 highway MPG! Of course it goes to .9 MPG WOT and 51 MPG at decel and cruise looks good, so I'd say it's working properly too!

TPS percent worked like a charm using oldpa3 data stream address!

Got one more data address I would give up, O2 cross counts. For AFR and tried some address in hac and got some data but I may need a calulation for it to work? Or may need 2 address? One gave constant changing number which didn't look right. The other 2 gave one number and quit, the other one gave one number and quit. So I may need to combine them 2... if it's even possible, but don't have any other data stream I would want to give up.

Just not much to work with on this old C3 160 baud...

Glad you posted this Greg, I learned a lot and had fun with it, will really help in future! :wtg:

[RobertISaar]

well Mark, you could expand the datastream to include more bytes, but then the updates would be even slower.

what dimented24x7 did for the 8063 ECM would be interesting to apply to the 7747: 38,400 baud.

no clue how he accomplished it though.

[gregs78cam]

I'm just glad I eventually got it right.
This is why I like TunerPro so much, the possibilities are almost endless. You can configure everything the way you want.

[1project2many]

So did you use the reference pulse counter or another variable? Are you able to configure it so displayed IDC is correct for the current firing mode?


The 808 Australian ECM had no ALDL hardware on board but it's not unusual for the Aussie guys to add it these days. There might be some neat ideas on delcohacking.net

[EagleMark]

well Mark, you could expand the datastream to include more bytes, but then the updates would be even slower.

what dimented24x7 did for the 8063 ECM would be interesting to apply to the 7747: 38,400 baud.

no clue how he accomplished it though.Probably just swap in a C4 before I'd try anything exotic like that. I think I'm about done with C3, if it wern't for having this clean ol 1990 Square Body Suburban for 10 years now I probably wouldn't have put this much effort into it! It's a bone stock daily driver that has taken care of me and the family while I do other projects and has never let us down.


I'm just glad I eventually got it right.
This is why I like TunerPro so much, the possibilities are almost endless. You can configure everything the way you want.Me too but I think the problem was the hac is just not as detailed as C4 stuff. TunerPro is amazing compared to using TC and DM or WinALDL together they are so limited. It really is an amazing piece of software for our purpose.


So did you use the reference pulse counter or another variable? Are you able to configure it so displayed IDC is correct for the current firing mode?


The 808 Australian ECM had no ALDL hardware on board but it's not unusual for the Aussie guys to add it these days. There might be some neat ideas on delcohacking.netNot yet, the only data log I had was short with only one small WOT and I did not see Asych flag come on. May need to do that with further testing. I have been doing some reading at delkohacking the past year but was mainly for ALDL modes.