two big $EE questions

[steveo]

it's nearly 20 years since EE was released, and i've taken too long of a break from disassembly.

there are two questions i really want to answer this year as i start tuning yet another LT1

1. where does the spark variance in power enrichment mode come from, and can it be tuned. i have (and other people have) observed at least a few degrees of additional timing that can't be explained by other tables.

2. how exactly is the VE table used when calculating airflow in MAF mode. the table lookup isn't skipped when using a maf. setting the VE table to rediculous values such as *1.9 or *0.2 causes a giant swing in AFR, so it's definitely used somehow.

[RobertISaar]

the EE speed-density vs MAF thing has always been something I've been curious about but never investigated..... assuming I have a day off soon, i'll probably dig around and see what comes up.

as for PE advance, that should be fairly easy to find, assuming other spark modifiers have been found/added to the XDF.

[RobertISaar]

looking through the code for VE vs MAF now.

at 6196, the code tests for the "speed-density" bit, if it is set, the MAF calcs appear to be skipped. so, speed-density appears to be in effect at all times.

there's actually so much important stuff missing from the XDF.... and it's ridiculous to accurately identify what a bunch of 2D and a few 3D tables are doing that aren't defined. I'm trying to find what I assume to be a MAF vs speed-density blend factor, but I haven't come across it yet.

[steveo]

that ku4ro guy that was kicking around before was making progress towards understanding fueling calcs but im not sure how far he got.

the thing is the factor which VE affects fueling in MAF mode is kinda the unknown variable. a blend table would make sense.

there are some really odd looking tables that kinda scale like fuel would, but i've never been able to track anything backwards to anything i understand as part of fueling calculations.

[steveo]

... but on the upside, i finally have the stuff to build a bench testing setup, a spare ECM, and i've mastered a lot of memory i/o stuff. i have sockets on order so i can protect against flash failures. so i can do a lot more discovery from the aldl side really soon..

mode 4 in this ecm is great. you can offset timing on the fly. it's nearly as good as an emulator for definining timing tables while driving. you can also do straight fuel offsetting in closed loop by forcing trims to stick in the current blm cell, then adding or subtracting.

[RobertISaar]

a lot of the later PCMs with mode 4 are similar in capabilities. dig far enough and you'll likely find some bits that will allow you to shut off individual or combinations of injectors. interesting for diagnostic purposes, along with seeing what happens when you shut off a bank or alternately shut off cylinders in the normal firing order. I found out a 3100 will apparently idle somewhat happily on 3 cylinders.

we need to get a good collaboration thread going and demystify what is probably the second most complex OBD1 controller GM released.... the 93-95 northstar PCM still feels like it has even more craziness going on.

[steveo]

dig far enough and you'll likely find some bits that will allow you to shut off individual or combinations of injectors

yep; and wrote a routine to use it to do automated cylinder drop test and report a snapshot of each cylinder's map sensor reading to find non-firing or weak cylinders easily. definitely nice to have.

we need to get a good collaboration thread going and demystify what is probably the second most complex OBD1 controller GM released

i wish i could be a bit more helpful with the disassembly. i can write complex branching routines in my own programs but when it comes to reading existing assembly, i still struggle to understand more complex routines. the amount of work that goes into writing a full 'hack' of an ecm is staggering.

[kur4o]

Hi to all.
I didn`t make great big progress lately but I post my latest findings.
The things about maf vs map.
Maf is used all the time except when MAf system error is set. Skip routine is located at loc_6337.
If Byte 2029 bit $08 = zero, Map calculations are always skipped.
If there is a spark adder routine it is located at loc_5F96, but still not sure what is doing.
I found that above 4000 rpm some tables are not updated every processor cycle, including main spark table. That may induce the spark adder but still not sure about it.
The skip routine is based on byte_a5, and it`s related to CYLID.

[RobertISaar]

looking at it with more sleep: interesting:

the XDF I have implies 2028 $2 to be the "speed-density" select bit. when the bit is clear, MAF calcs are allowed. when set, all of the MAF calcs are jumped over(code immediately shoots down to 6379(which goes through the logic of cranking vs low vs high VE tables).

2029 $8 does appear to allow/disallow speed-density calcs...

so, 2028 $2 might be better described as "MAF disable" and 2029 $8 might be better described as "speed-density enable", which would appear to allow the program to run in either exclusively speed-density or exclusively MAF.

[steveo]

2029 bit 8 does appear to be unset in every factory calibration including speed density caprice bins

maybe i should flip the bit and go for a drive with a flat 80% VE table and see what happens

[RobertISaar]

you probably don't want to flash it more times than necessary, but I would try a run with just the bit changed, then a run with the bit changed and a borked VE table, just to make sure it doesn't affect other stuff in the calibration.

[steveo]

i'll probably have a chance tomorrow. the weather is really nice and im doing the two wheel thing right now. good thing it isn't tuneable, or i'd surely be putting any $EE on hold for the entire summer.

[bybyc5]

You guys are way above my pay grade..
I would love to understand the hack process, and read a lot of these threads in awe. And get lost quick!

I would love to be able to set a closed loop target afr in these pcm's. Like in my K1500 16168625, setting this from 14.7 to 14.1 made a world of difference. Now that we have more ethanol added to our fuel which we didn't have as much of back in the early 90's. This does change our true closed loop afr.

I have tuned a few LT1 obd1 PCM's over the years and always wanted a richer closed loop target afr.

Just wondering if you have located this part of the diss-assembly?

Thank you,

Keith

[steveo]

I would love to be able to set a closed loop target afr in these pcm's. Like in my K1500 16168625, setting this from 14.7 to 14.1 made a world of difference. Now that we have more ethanol added to our fuel which we didn't have as much of back in the early 90's. This does change our true closed loop afr.

see attachment. you have to change both to match.

You guys are way above my pay grade..
I would love to understand the hack process, and read a lot of these threads in awe. And get lost quick!

i know how you feel.

i am a total assembly noob, i wish i could help more with it.

i'm a fairly good programmer with low level languages, in fact i could certainly write this entire thing in assembly if i had the time. i've written assembly for control systems before.

but understanding existing assembly like this is just a mindf#%k to me sometimes.

sometimes you find a variable, and you're like ok. this is obviously a fuel scaler thingie. it's multiplied against the injector constant. it's referenced again near a routine that looks at the VE table. obviously increasing it would increase fuel, and decreasing it would decrease fuel.

but what is it, and why is it there!? if it's linear, why wasn't it just rolled into the injector constant!?

and you scratch your head.. and stare at it...

then you see some other comare operation done against it where spark is computed, and you don't even know what to think anymore.

truth is except for simple routines, and my initial re-hack on the EE xdf, guys like robert and kur4o are miles ahead of me. i just test, use, organize, and spread the word about stuff that they find. once the notes are made i can read the instructions and totally understand how it works, but before that it's greek to me.

a complete 'hack' of a simple ecm is known to take a reaaaaly long time from scratch; this is two ecms. so im suprising nobody has invested the time to get everything out of it. but everything new that's found is really exciting to me, even if i can't use it on my own car..

[kur4o]

If you want to change Stoich AFR you also need to change two bytes on Tside
byte_e0e5 and byte_8227 or BLM update won`t happen

All 4 bytes must have same value.