weird numbers

Anything about Ford EEC tuning. TwEECer and Moates questions dominate, but there's some SCT and OBD-II knowledge too.

Moderators: cgrey8, EDS50, 2Shaker, Jon 94GT

Post Reply
themustangman
Gear Head
Posts: 5
Joined: Mon Oct 23, 2006 11:36 pm

weird numbers

Post by themustangman » Tue Apr 10, 2007 12:37 am

So i went and stole my eec out of my car that is at the body shop. Its a speed denisty da1 when i plug it in it gives me some numbers that dont make sense for exampleit says number_or_cylinders 2047.97. i know their arent many sd guys here but can some one help

sailorbob
BIN Hacker
Posts: 1672
Joined: Tue Jul 12, 2005 6:10 am

Post by sailorbob » Tue Apr 10, 2007 5:02 am

Can you provide a bit more info please? e.g. what hardware and editor you are using.

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Post by cgrey8 » Tue Apr 10, 2007 7:11 am

Knowing the HW and editor would certainly help, but it sounds like you are trying to view your EEC's tune using the wrong strategy.
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

themustangman
Gear Head
Posts: 5
Joined: Mon Oct 23, 2006 11:36 pm

Post by themustangman » Tue Apr 10, 2007 1:20 pm

i am using a tweecer.i know i am using the right statergy the da1 uses the da1 stratergy right?

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Post by cgrey8 » Tue Apr 10, 2007 2:17 pm

That, I'm not sure of. There are only a few EECs out there that follow a strategy by the same name as themselves...and no A9L and A9M are not one of them. They follow GUFB strategy which isn't named right in CalEdit.
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

sailorbob
BIN Hacker
Posts: 1672
Joined: Tue Jul 12, 2005 6:10 am

Post by sailorbob » Tue Apr 10, 2007 2:29 pm

The DA1 ecu is one where no one seems to know what the strategy is called. I know I ended up referring to the strategy as DA1 for this ecu and the DB1 ecu because of this.

My guess would be that your problem is you haven't got a good read from your ecu and the binary is corrupt. Are the J3 contacts scrupulously clean?

themustangman
Gear Head
Posts: 5
Joined: Mon Oct 23, 2006 11:36 pm

Post by themustangman » Thu Apr 12, 2007 2:03 am

The j3 port is clean,still no luck.Is it possible my tweecer or my eec are broke

User avatar
86GT
BE/EA Developer
Posts: 5096
Joined: Sat Feb 22, 2003 11:19 pm
Location: Dixon, California
Contact:

Post by 86GT » Thu Apr 12, 2007 2:41 am

sailorbob wrote:The DA1 ecu is one where no one seems to know what the strategy is called. I know I ended up referring to the strategy as DA1 for this ecu and the DB1 ecu because of this.

My guess would be that your problem is you haven't got a good read from your ecu and the binary is corrupt. Are the J3 contacts scrupulously clean?

I am not to sure in the one bank bins but the multi bank bins the strategy is as follows.

the strategy is listed in the last 256 bytes of bank 9. Use a hex viewer and goto the end of the file -- the VIN is listed there too

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Post by cgrey8 » Thu Apr 12, 2007 7:46 am

That means if you have one of the larger BINs, you could actually open the BIN and automatically choose the strategy for that BIN?

Do I smell a feature request (obviously once more are supported)?

Even for the smaller BINs, there has to be something you can trigger off of to determine what the strategy is...some value or series of values that NEVER get touched in the course of normal tuning (i.e. look for specific opcodes or formulas at certain offsets, they are never changed as part of tuning). Then associate that string and the offset into the Definition file. Then all a user has to do is open the BIN and BE will go searching for commonalities to see if it can support it. Talk about streamlining tuning for people. If BE supported most of the strategies that CalEdit does, you could make things REAL easy for users...almost to the point of not needing to know what strategy your BIN is.

Thoughts?
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

User avatar
86GT
BE/EA Developer
Posts: 5096
Joined: Sat Feb 22, 2003 11:19 pm
Location: Dixon, California
Contact:

Post by 86GT » Thu Apr 12, 2007 10:38 am

Mike tried this at frist too. There is way to many different ones to try this on. I could see maybe the multi bank ones since it is spell out, but I dont think I will make it automatic.

I may autoselect the bank size from the bins file size.

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Post by cgrey8 » Thu Apr 12, 2007 11:10 am

It doesn't have to be something that you do as a matter of practice. It can be a 1-time thing that is a button like Identify My EEC which uploads the EEC bin and runs a comparison of it, starting with the most common strategies like GUFx, CBAZA, then onto the next most common, and so on. If this takes a few minutes, have a pop-up that indicates this may take a while, especially if you get 100+ different definition files into BE. You could even have the user narrow down the search by having them enter the EEC's code (i.e. A9L, J4J1, etc) and then start by looking that EEC up in an internal database and verify that it does match the description given if it is a known EEC. If that comparison doesn't pan out, then move on with a brute-force comparison of the EEC with all known strategies you have definition files for. Would that work?
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

sailorbob
BIN Hacker
Posts: 1672
Joined: Tue Jul 12, 2005 6:10 am

Post by sailorbob » Thu Apr 12, 2007 1:41 pm

Ford use the checksum to identify the ecu on eec-iv's. If the calculated checksum on two different ecu's works out to be the same then the FIXSUM parameter is altered to overcome this. Obviously using the checksum to identify a modified bin isn't an option.

User avatar
86GT
BE/EA Developer
Posts: 5096
Joined: Sat Feb 22, 2003 11:19 pm
Location: Dixon, California
Contact:

Post by 86GT » Thu Apr 12, 2007 2:31 pm

sailorbob wrote:Ford use the checksum to identify the ecu on eec-iv's. If the calculated checksum on two different ecu's works out to be the same then the FIXSUM parameter is altered to overcome this. Obviously using the checksum to identify a modified bin isn't an option.
True this would only get you the identification of an untouched bin

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Post by cgrey8 » Thu Apr 12, 2007 2:49 pm

But for a new user just starting out, that's all they'd need...just some way for them to know what strategy their EEC is before they really understand what strategy, definition file, and all that really means. What I'd be more concerned about is what if the strategy was supported, but you just happened to not have a BIN that matched their EEC (i.e. they have an A3M1 but you don't have an A3M1.BIN to compare against, however BE does support their strategy). To be fool-proof, you really need some way to identify the strategy, not the BIN. In the case of an A3M1, I assume all the Opcodes and operands would be in exactly the same offsets and thus you could verify against say 10 different opcodes that are scattered around in the BIN (not back to back). In some places, GUFA, GUFB, and GUFC are similar. I'd think if you happened to look in the right place, you could wrongfully identify a GUFA as GUFB or vice-versa.
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

jsa
Tuning Addict
Posts: 610
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: weird numbers

Post by jsa » Thu May 23, 2019 3:50 am

Digging up dinosaur bones here, why do the definitions change rom_to when a tune is changed?

Why is fixsum not used so that the strategy can still be recognised via the rom_to value for eec-iv?
Cheers

John

95 Escort RS Cosworth - GHAJ0 / ANTI on a COSY box code
Moates QH & BE
ForDiag

User avatar
cgrey8
Administrator
Posts: 10714
Joined: Fri Jun 24, 2005 5:54 am
Location: Acworth, Ga (Metro Atlanta)
Contact:

Re: weird numbers

Post by cgrey8 » Thu May 23, 2019 5:59 am

I remember so little about the rom_to thing, I don't have any thoughts for an answer. Hopefully somebody else remembers this stuff well enough to answer.
...Always Somethin'

89 Ranger Supercab, 331 w/GT40p heads, ported Explorer lower, Crane Powermax 2020 cam, 1.6RRs, FMS Explorer (GT40p) headers, Slot Style MAF, aftermarket T5 'Z-Spec', 8.8" rear w/3.27s, Powertrax Locker, Innovate LC-1, GUFB, Moates QuarterHorse tuned using BE&EA

Member V8-Ranger.com

jsa
Tuning Addict
Posts: 610
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: weird numbers

Post by jsa » Thu May 23, 2019 7:50 am

Yes, I hope Clint and Sailorbob chime in about the choice.

My followup question is why has a word not been stuck into the logging patchcode for the purpose nulling out the change the patchcode causes to checksum? It seems unecessary to have a checksum error in place while logging when an extra word could be set.
Cheers

John

95 Escort RS Cosworth - GHAJ0 / ANTI on a COSY box code
Moates QH & BE
ForDiag

User avatar
86GT
BE/EA Developer
Posts: 5096
Joined: Sat Feb 22, 2003 11:19 pm
Location: Dixon, California
Contact:

Re: weird numbers

Post by 86GT » Thu May 23, 2019 11:49 am

The ROM_TO parameter is where the programmer sets the checksum value. The PCM then recalculates the checksum when the key is cycled. If they match then all is good and no CEL. If they do not match then the CEL will come on. It is the only way the PCM can verify that the ROM has not changed from its original.

jsa
Tuning Addict
Posts: 610
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: weird numbers

Post by jsa » Thu May 23, 2019 4:32 pm

Agree, the checksum is calculated by the PCM by summing all the values in an address range. The address range is defined by a start and end value that is part of the binary.

BE receives an address via ChecksumStore that is ROM_TO in all the defintion files I have seen. BE then adjusts the content of that address, when tuning changes are made, to maintain the correct checksum.

The address supplied by def authors for ChecksumStore could be anything within the checksum range, why is ROM_TO the suggested default ChecksumStore?

It seems FIXSUM or an unused word address would provide a better result by maintaining strategy ID for other tools on eec-iv.

For logging patchcode, is it an intended decision or unintended consequence that checksum is broken while patchcode is in place?
Cheers

John

95 Escort RS Cosworth - GHAJ0 / ANTI on a COSY box code
Moates QH & BE
ForDiag

User avatar
86GT
BE/EA Developer
Posts: 5096
Joined: Sat Feb 22, 2003 11:19 pm
Location: Dixon, California
Contact:

Re: weird numbers

Post by 86GT » Thu May 23, 2019 5:02 pm

The so call ChecksumStore is not determined by us. It was determined by ford or the compiler that they used at the time. Since the GUFx strategy is public domain now and the document describes the ROM_TO this is what i used when programming BE. It has just stuck from there.

Yes we could use any place in the rom but we have to make sure to exclude the checksum itself from the calculation. I am not sure that the strategy ID is the the checksum. Maybe it is on the EEC4 but it is definitely not on the EEC5. I am not sure of any other software that uses the checksum as the identifier. I don't use any of the other software LOL.

Patch code, when inserted, the checksum is updated. I will have to double check that in the code. It has been a few years since I have looked at it.

jsa
Tuning Addict
Posts: 610
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: weird numbers

Post by jsa » Thu May 23, 2019 6:42 pm

86GT wrote:
Thu May 23, 2019 5:02 pm
Yes we could use any place in the rom but we have to make sure to exclude the checksum itself from the calculation.
So, in calculation of a checksum adjustment, BE skips the address assigned to ChecksumStore in the definition? The EEC itself includes it for the test otherwise it would have no effect on correction of the sum result.
I am not sure that the strategy ID is the the checksum. Maybe it is on the EEC4 but it is definitely not on the EEC5. I am not sure of any other software that uses the checksum as the identifier. I don't use any of the other software LOL.
It appears to hold true, as Sailorbob stated above, across a number of different EEC-IV's. I have ForDiag. It appears to use ROM_TO to ID the catchcode within a strategy. Choosing a location within checksum range, other than ROM_TO, for ChecksumStore looks to achieve correct checksum and retain ID's.
Patch code, when inserted, the checksum is updated. I will have to double check that in the code. It has been a few years since I have looked at it.
I have an end user scalar word to manually tweak checksum when patchcode is loaded, otherwise checksum was not correct with patchcode in play.

When attempting, logging checksum adjustment, is BE checking the address of each line of patchcode and payload in the definition to see if it is within the range of ChecksumStart and ChecksumEnd?

For logging patches I have seen, some have;
* Patchcode and payload within the console routine and Checksum range
* Patchcode within the console routine and Checksum range, but payload beyond checksum range. For space reasons or easier manual checksum maintenance.
* A call or jump to patchcode and payload. Unconfirmed location relative to Checksum range.

Are you expecting a correctly configured definition and correctly working BE to amend the value of ChecksumStore when some portion of the logging code is applied within checksum range?

Edit: Corrected misleading info about ForDiag ROM_TO/Fixsum and calibration/startegy ID.
Last edited by jsa on Fri May 24, 2019 7:52 pm, edited 1 time in total.
Cheers

John

95 Escort RS Cosworth - GHAJ0 / ANTI on a COSY box code
Moates QH & BE
ForDiag

sailorbob
BIN Hacker
Posts: 1672
Joined: Tue Jul 12, 2005 6:10 am

Re: weird numbers

Post by sailorbob » Fri May 24, 2019 4:22 am

The ROM_TO checksum value does not identify a strategy, it identifies the calibration. The FIXSUM parameter is used by Ford to ensure that the ROM_TO value is unique.

jsa
Tuning Addict
Posts: 610
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: weird numbers

Post by jsa » Fri May 24, 2019 7:42 pm

Thanks for the correction Sailorbob.
Cheers

John

95 Escort RS Cosworth - GHAJ0 / ANTI on a COSY box code
Moates QH & BE
ForDiag

Post Reply

Who is online

Users browsing this forum: No registered users and 9 guests