EECTuning.org

That's the theory. However, over the years, I have been sent several calibrations that contain the patch code but no payload items that people have read from their tuning device.

Chucko wrote: ↑

Sat Jun 29, 2019 1:04 pm

The original code has the same behavior.

My apologies, the original has this same flaw too. Sloppy coding

BTW, jne and jnz are the same instruction.

The original flaw is still in there, look at what you are loading into 0x0014 on the first pass through.

The flaw has nothing to do with the location of the payload list.

The original code does not have this flaw, look at what you are loading into 0x0014 on the first pass through.

Your modification risks crashing the code as the check for the zero marker will be missed if there are no datalog payload items. You are also reducing the number of payload items.

My understanding of it is: n = number of bytes to read (starting from the address defined by MMSB, MSB, LSB) MMSB = bank ( 0, 1, 2 or 3) MSB = high byte of address LSB = low byte if address It will probably baulk if you try to read more bytes than there are between the start address and the end of t...

Sorry, I meant POPP not POPW above (that's a different instruction!).

The interrupts are not necessarily enabled after the subroutine has finished being executed. The PUSHP instruction saves the PSW register to the stack and bit 15 is the 'interrupt enable' bit. The later POPW instruction restores the PSW register to the condition it was at the point when it was saved...

The ROM_TO checksum value does not identify a strategy, it identifies the calibration. The FIXSUM parameter is used by Ford to ensure that the ROM_TO value is unique.

The 'Nominal_AFR' parameter (regardless of whether it is defined as a calibrateable parameter in a strategy or exposed as a hack) is the value the ECU uses to calculate the amount of fuel needed to achieve a stoichiometric A/F ratio for gasoline (I cannot recall seeing any stock calibration using an...

It's dying because it's overfuelling. When it gets close to the desired idle rpm, if you look near ET 57.224 shortly after the spark changes from 'idle feedback at minimum clip' to 'idle feedback', the injector pw increases and keeps on doing so until the engine stalls. You need to identify what's c...

For the sake of moving four more injector wires I think that is preferable to playing around with the injector firing order and injector output port.

What is the engine? I am curious why the injector firing order has been changed.

SMD-333 is used on the '94-'95 5.0 L manual transmission Mustangs.

I am guessing from the lack of response that no one knows. I suspect that Paul's EEC Editor may well be the only software to support that hardware.

'A' is closest; the BE executable was installed rather then the full installer program.

If you are just using the wideband controller's 0-5 volt output as an input into the eec to datalog via an unused A-D line (such as the EGR) then BE does not care what controller you are using.

The calibrations were supplied as binary files to the chip manufacturers, this is described in the ROM identification section of the strategy documents.

One of the options the LA3 ecu uses to determine when to go into open loop fuelling is a simple rpm vs air charge function together with a global air charge multiplier. It probably looks like it always goes into open loop at 3000 rpm because the air charge value at 3000 rpm is less than a sixth of t...

Have a look a couple of lines above, at 0x4456, where a different entry point to the subroutine is used.

I also wonder why Ford didn't simply do a LDW to get both registers in one hit Bits 8-15 of some special function registers are only accessible using a word sized read or write of an even valued memory address. This feature of the MCU looks like it's only used on the 8065 (for example, see the HSO ...

It's not obfuscation, just a neat way of saving 8 state times. I doubt you could automate commenting this out in the disassembly due to its subtlety.

This is just a bit of cute coding by Ford, in this particular instance using SHRDW has saved using SHRW twice (i.e. separately on 0x38 and 0x3A) as the value is 0x38 is not double word sized and the lowermost bits of 0x3A are zero.

Even if the temperature at the sensor is greater than 254 deg F the ACT value is limited in the code to a maximum of 254 deg F.

Providing the first and last input (Y axis) values for the function are set to the maximum and minimum limits of the input variable then there is not going to be a problem as the function's interpolated output value will be limited to be within those values in the function. Problems which occurs in ...

I believe the 4TAB ecu has an 88k rom so I suspect both of the bin files you have are not correct.

I've just issued an updated definition that includes the DFSFLG flag so you will be able to see if DFSO is causing your issue.

Are you sure it's going into DFSO?

Are you allowing the use of the DFSO Profile Correction mode? If you are then the normal DFSO parameters won't disable DFSO if the relevant KAM correction factors have not matured.