This is where the BIN Hackers and definition junkies discuss the inner workings of the EEC code and hardware. General tuning questions do not go here. Only technical/hardware-specific/code questions and discussions belong here.

Moderators: cgrey8, EDS50, Jon 94GT, 2Shaker

Post Reply
jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

3DBC patch code

Post by jamie from oz » Mon Jul 17, 2023 5:28 pm

HI.
Australian ED2 Falcon 6cyl EEC-iv catch code 3DBC and hardware code ETV_456.

I have run 3DBC bin through SAD and sorting through the list.

I am looking to create a patch code for the QH and not sure which line to start the patch in the code ?
0x84E9 is referenced several times in the vector list but the [d00] reference is at 0x84DB and not in vector list.

was looking to use the fill at 0x8776 to 0x878F for the data if its suitable.

Jamie

Code: Select all

84c8: fb                  ei                     interrupts ON;
84c9: a1,f0,00,18         ldw   R18,f0           R18 = f0;
84cd: b3,01,20,20,1a      ldb   R1a,[R0+2020]    R1a = [2020];
84d2: a2,15,1c            ldw   R1c,[R14++]      R1c = [Rcr14];
84d5: c2,19,1c            stw   R1c,[R18++]      [R18++] = R1c;
84d8: e0,1a,f7            djnz  R1a,84d2         R1a--;
                                                 if (R1a != 0) goto 84d2;
84db: a3,01,00,0d,14      ldw   R14,[R0+d00]     Rcr14 = [d00];
84e0: 99,3b,15            cmpb  R15,3b           
84e3: d7,03               jne   84e8             if (R15 = 3b)  {
84e5: ef,18,8b            call  1000             1000 (); }
84e8: f0                  ret                    return;

   Sub_84e9_patch?:
84e9: a3,01,f2,1f,30      ldw   R30,[R0+1ff2]    R30 = [1ff2];
84ee: 89,1c,1f,30         cmpw  R30,1f1c         
84f2: d7,06               jne   84fa             if (R30 = 1f1c)  {
84f4: c9,fa,84            push  84fa             push(Sub_84fa);
84f7: e7,22,9a            jump  1f1c             goto 1f1c; }
   Sub_84fa:
84fa: c7,01,56,02,00      stb   R0,[R0+256]      256_timer = 0;
84ff: f0                  ret                    return;

   Sub_8500:
8500: a1,37,04,22         ldw   R22,437          R22 = 437;

Code: Select all

8762: ad,6c,30            ldzbw R30,6c           wR30 = 6c;
8765: c7,31,f1,03,3a      stb   R3a,[R30+3f1]    [R30+3f1] = R3a;
876a: e0,30,f8            djnz  R30,8765         R30--;
                                                 if (R30 != 0) goto 8765;
876d: a1,00,36,38         ldw   R38,3600         R38 = 3600; }
8771: c3,72,82,38         stw   R38,[R72+82]     [3f0] = R38;
8775: f0                  ret                    return;

8776: ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff  ???  
8786: ff,ff,ff,ff,ff,ff,ff,ff,ff,ff  ???  

8790: 4c,8a               word   8a4c            Rbase_f0
8792: 00,40               word   4000
8794: 37                  byte     37            ACT_Defult
8795: 66                  byte     66
8796: b0                  byte     b0
8797: c8                  byte     c8
8798: 07,03               word    307
879a: 5a,00               word     5a
879c: 18,06               word    618
BE_3DBC_12A.BIN
(56 KiB) Downloaded 279 times
ZZ_BE_3DBC_12A_lst.txt
(644.76 KiB) Downloaded 298 times
ZZ_BE_3DBC_12A_dir.txt
(41.81 KiB) Downloaded 303 times
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Tue Jul 18, 2023 4:11 am

Jamie,

Start the patch at 0x847E, it is in the BG vector list and is the console sub.

Code: Select all

   Sub_847e:
847e: fa                  di                     interrupts OFF;
847f: a3,01,00,0d,14      ldw   R14,[R0+d00]     Rcr14 = [d00];
8484: 99,2a,15            cmpb  R15,2a                                        # No console so not equal
8487: d7,3b               jne   84c4             if (R15 = 2a)  {             # Jump
8489: 38,0a,1b            jb    B0,Ra,84a7       if (HSO_OVF = 0)  {
848c: 47,01,0e,20,06,7c   ad3w  R7c,R6,[R0+200e] R7c = IO_Timer + [200e];
8492: d7,02               jne   8496             if (R7c = 0)  {
8494: 07,7c               incw  R7c              R7c++; }
8496: a0,7c,0e            ldw   Re,R7c           HSI_Time = R7c;
8499: b1,0f,0d            ldb   Rd,f             HSO_Cmd = f;
849c: c9,a7,84            push  84a7             push(Sub_84a7);
849f: ad,00,30            ldzbw R30,0            wR30 = 0;
84a2: cb,31,66,84         push  [R30+8466]       push([R30+8466]);
84a6: f0                  ret                    return; }

   Sub_84a7:
84a7: a3,01,80,0c,14      ldw   R14,[R0+c80]     Rcr14 = [c80];
84ac: ad,00,30            ldzbw R30,0            wR30 = 0;
84af: a3,31,78,84,42      ldw   R42,[R30+8478]   R42 = [R30+8478];
84b4: c6,42,00            stb   R0,[R42]         [R42] = 0;
84b7: 36,14,0a            jnb   B6,R14,84c4      if (B6_Rcr14 = 1)  {
84ba: ad,00,30            ldzbw R30,0            wR30 = 0;
84bd: a3,31,72,84,14      ldw   R14,[R30+8472]   Rcr14 = [R30+8472];
84c2: 20,04               sjmp  84c8             goto 84c8; } }

84c4: a1,22,20,14         ldw   R14,2022         Rcr14 = 2022;                # Jump here
Start the payloads at 0xA000, outside the checksum range.

Code: Select all

7e38: 00,20               word   2000
7e3a: fe,9f               word   9ffe

9fac -> bfff = 0xff  ## fill ## 
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Tue Jul 18, 2023 4:23 am

Thank you John.

I will try to make the patch and see if works in SAD and post the result .

Jamie.
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Tue Jul 18, 2023 8:27 am

This is what i have so far.

(addresses from SAD - 0x2000 for BE read)

Qhorse tab.

Code: Select all

ADDRESS	DATA		Parameter	Value
0x647E	0xFA		DatalogOffset	1000
0x647F	0xA1		LTMTB1	0704
0x6480	0x00		LTMTB2	075A
0x6481	0x80			
0x6482	0x3A			
0x6483	0x46			
0x6484	0x43			
0x6485	0x00			
0x6486	0x14			
0x6487	0xd6			
0x6488	0x32			
0x6489	0xA2			
0x648A	0x14			
0x648B	0x30			
0x648C	0xC3			
0x648D	0x15			
0x648E	0x00			
0x648F	0x10			
0x6490	0x30			
0x6491	0x27			
0x6492	0xF0			
0x6493	0xFB			
0x6494	0xFF			
0x6495	0xFF			
0x6496	0xFF			
0x6497	0xFF			
0x6498	0xFF			
0x6499	0xFF			
0x649A	0xFF			
0x649B	0xFF			
0x649C	0xFF			
0x649D	0xFF			
0x649E	0xFF			
0x649F	0xFF			
0x64A0	0xFF			
0x64A1	0xFF			
0x64A2	0xFF			
0x64A3	0xFF			
0x64A4	0xFF			
0x64A5	0xFF			
0x64A6	0xF0			
0x8000	0000			
0x8001	0xFF			
0x8002	0xFF			
This is the SAD result.

Code: Select all

   Sub_847e:
847e: fa                  di                     interrupts OFF;
847f: a1,00,80,3a         ldw   R3a,8000         R3a = 8000;
8483: 46,43,00,14         ad3w  R14,R0,[R42++]   R14 = [R42++];
8487: d6,32               jge   84bb             if (R14 < 0)  {
8489: a2,14,30            ldw   R30,[R14]        R30 = [R14];
848c: c3,15,00,10,30      stw   R30,[R14+1000]   [R14+1000] = R30;
8491: 27,f0               sjmp  8483             goto 8483;

8493: fb,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff  ???  
84a3: ff,ff,ff,f0,

84a7: a3,01,80,0c,14,ad,00,30,a3,31,78,84  ??? 
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Tue Jul 18, 2023 3:23 pm

jamie from oz wrote: Tue Jul 18, 2023 8:27 am
(addresses from SAD - 0x2000 for BE read)

Qhorse tab.

Code: Select all

ADDRESS	DATA		Parameter	Value
0x647E	0xFA		DatalogOffset	1000
0x647F	0xA1		LTMTB1	0704
0x6480	0x00		LTMTB2	075A
0x6481	0x80			
0x6482	0x3A
No 2k offset for Qhorse and Payload tabs. BE uses actual addresses for these tabs, not file addresses.

Keep in mind the patchcode is the actual code the EEC will execute. The EEC will take 0x8000 literally, BE does not translate the patch and the EEC will not add 2k.
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Tue Jul 18, 2023 5:26 pm

Ok .

I will correct that.

Thanks very much John.
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Wed Jul 19, 2023 7:13 am

I corrected the Qhorse tab.

I have loaded tune to QH and engine starts and runs.

When i start datalogging it dies so i obviously have something wrong in the patch code.
I will re check what i have done.

Code: Select all

ADDRESS	DATA		Parameter	Value
0x847E	0xFA		DatalogOffset	1000
0x847F	0xA1		LTMTB1	0704
0x8480	0x00		LTMTB2	075A
0x8481	0xA0			
0x8482	0x3A			
0x8483	0x46			
0x8484	0x43			
0x8485	0x00			
0x8486	0x14			
0x8487	0xd6			
0x8488	0x32			
0x8489	0xA2			
0x848A	0x14			
0x848B	0x30			
0x848C	0xC3			
0x848D	0x15			
0x848E	0x00			
0x848F	0x10			
0x8490	0x30			
0x8491	0x27			
0x8492	0xF0			
0x8493	0xFB			
0x8494	0xFF			
0x8495	0xFF			
0x8496	0xFF			
0x8497	0xFF			
0x8498	0xFF			
0x8499	0xFF			
0x849A	0xFF			
0x849B	0xFF			
0x849C	0xFF			
0x849D	0xFF			
0x849E	0xFF			
0x849F	0xFF			
0x84A0	0xFF			
0x84A1	0xFF			
0x84A2	0xFF			
0x84A3	0xFF			
0x84A4	0xFF			
0x84A5	0xFF			
0x84A6	0xF0			
0xA000	0000			
0xA001	0xFF			
0xA002	0xFF			
0xA003	0xFF			
0xA004	0xFF			
0xA005	0xFF			
0xA006	0xFF			
0xA007	0xFF			
0xA008	0xFF			
0xA009	0xFF			
0xA00A	0xFF			
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Wed Jul 19, 2023 7:28 am

think it may have been 0x8484 that i had wrong as it was referencing [R42++] when i was ment to have [R14++] in there.

will load that tomorrow and see if it will data log.

Code: Select all

8474: 00,12,00,12,00,c0,00,10,00,10  ???  

   Sub_847e:
847e: fa                  di                     interrupts OFF;
847f: a1,00,a0,3a         ldw   R3a,a000         R3a = a000;
8483: 46,15,00,14         ad3w  R14,R0,[R14++]   R14 = [R14++];
8487: d6,32               jge   84bb             if (R14 < 0)  {
8489: a2,14,30            ldw   R30,[R14]        R30 = [R14];
848c: c3,15,00,10,30      stw   R30,[R14+1000]   [R14+1000] = R30;
8491: 27,f0               sjmp  8483             goto 8483;

8493: fb,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff  ???  
84a3: ff,ff,ff,f0,a3,01,80,0c,14,ad,00,30,a3,31,78,84  ??? 
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Wed Jul 19, 2023 5:37 pm

Changing the scratch registers used in the patch, to suit the particular bin, is all part of the process. I'll assume you have chosen wisely.
jamie from oz wrote: Wed Jul 19, 2023 7:28 am think it may have been 0x8484 that i had wrong as it was referencing [R42++] when i was ment to have [R14++] in there.
You have changed R42 to R3A...
I've posed some rhetorical questions, they can be discussed further if you wish.

Code: Select all

ADDRESS	DATA	
0x8482	0x3A			
0x8483	0x46
0x8484	0x43          <<< Should be 0x3B not 0x43 or 0x15
0x8485	0x00			
0x8486	0x14		### Z Flag set if R14 = 0000. N Flag set if R14 = FFFF
0x8487	0xd6		<<< What flags are being tested???	
0x8488	0x32		<<< What is behind your decision to jump to 0x84BB???	
	
0x848E	0x00			
0x848F	0x10		<<< What is behind your decision to go with 0x1000 payload offset???
0x8490	0x30			

0x8498	0xFF         <<< I think you have used my 6DBX patch as the template for 3DBC
0x8499	0xFF         <<< Was 0x89,0xFB in 6DB intentional on my part???

0xA000	0000		
0xA001	0xFF			
0xA002	0xFF			
0xA003	0xFF			
0xA004	0xFF			
0xA005	0xFF			
0xA006	0xFF			
0xA007	0xFF			
0xA008	0xFF			
0xA009	0xFF			
0xA00A	0xFF		### Why have so few payload slots??? 
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Thu Jul 20, 2023 2:16 am

Yes i used your patch code for a template.
0x1000 and the other R14 etc was referenced in the original bin i pulled with QH and BE and thought i would try that first to see if i had learned any thing about how it was relevent.

edit : looking at the reference to R3b i see that it makes sense as it is used more as table output and R34 / R30 probbably make more sense also as function registers.

I clearly dont understand the code yet and would like help sorting it please.

payload goes further than what i had posted and didnt think that was required in the post.

Code: Select all

ADDRESS	DATA		Parameter	Value
0x847E	0xFA		DatalogOffset	1000
0x847F	0xA1		LTMTB1	0704
0x8480	0x00		LTMTB2	075A
0x8481	0xA0			
0x8482	0x3A			
0x8483	0x46			
0x8484	0x15			
0x8485	0x00			
0x8486	0x14			
0x8487	0xd6			
0x8488	0x32			
0x8489	0xA2			
0x848A	0x14			
0x848B	0x30			
0x848C	0xC3			
0x848D	0x15			
0x848E	0x00			
0x848F	0x10			
0x8490	0x30			
0x8491	0x27			
0x8492	0xF0			
0x8493	0xFB			
0x8494	0xFF			
0x8495	0xFF			
0x8496	0xFF			
0x8497	0xFF			
0x8498	0xFF			
0x8499	0xFF			
0x849A	0xFF			
0x849B	0xFF			
0x849C	0xFF			
0x849D	0xFF			
0x849E	0xFF			
0x849F	0xFF			
0x84A0	0xFF			
0x84A1	0xFF			
0x84A2	0xFF			
0x84A3	0xFF			
0x84A4	0xFF			
0x84A5	0xFF			
0x84A6	0xF0			
0xA000	0000			
0xA001	0xFF			
0xA002	0xFF			
0xA003	0xFF			
0xA004	0xFF			
0xA005	0xFF			
0xA006	0xFF			
0xA007	0xFF			
0xA008	0xFF			
0xA009	0xFF			
0xA00A	0xFF			
0xA00B	0xFF			
0xA00C	0xFF			
0xA00D	0xFF			
0xA00E	0xFF			
0xA00F	0xFF			
0xA010	0xFF			
0xA011	0xFF			
0xA012	0xFF			
0xA013	0xFF			
0xA014	0xFF			
0xA015	0xFF			
0xA016	0xFF			
0xA017	0xFF			
0xA018	0xFF			
0xA019	0xFF			
0xA01A	0xFF			
0xA01B	0xFF			
0xA01C	0xFF			
0xA01D	0xFF			
0xA01E	0xFF			
0xA01F	0xFF			
0xA020	0xFF			
0xA021	0xFF			
0xA022	0xFF			
0xA023	0xFF			
0xA024	0xFF			
0xA025	0xFF			
0xA026	0xFF			
0xA027	0xFF			
0xA028	0xFF			
0xA029	0xFF			
0xA02A	0xFF			
0xA02B	0xFF			
0xA02C	0xFF			
0xA02D	0xFF			
0xA02E	0xFF			
0xA02F	0xFF			
0xA030	0xFF			
0xA031	0xFF			
0xA032	0xFF			
0xA033	0xFF			
0xA034	0xFF			
0xA035	0xFF			
0xA036	0xFF			
0xA037	0xFF			
0xA038	0xFF			
0xA039	0xFF			
0xA03A	0xFF			
0xA03B	0xFF			
0xA03C	0xFF			
0xA03D	0xFF			
0xA03E	0xFF			
0xA03F	0xFF			
0xA040	0xFF			
0xA041	0xFF			
0xA042	0xFF			
0xA043	0xFF			
0xA044	0xFF			
0xA045	0xFF			
0xA046	0xFF			
0xA047	0xFF			
0xA048	0xFF			
0xA049	0xFF			
0xA04A	0xFF			
0xA04B	0xFF			
0xA04C	0xFF			
0xA04D	0xFF			
0xA04E	0xFF			
0xA04F	0xFF			
0xA050	0xFF			
0xA051	0xFF			
0xA052	0xFF			
0xA053	0xFF			
0xA054	0xFF			
0xA055	0xFF			
0xA056	0xFF			
0xA057	0xFF			
0xA058	0xFF			
0xA059	0xFF			
0xA05A	0xFF			
0xA05B	0xFF			
0xA05C	0xFF			
0xA05D	0xFF			
0xA05E	0xFF			
0xA05F	0xFF			
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Fri Jul 21, 2023 4:25 am

jamie from oz wrote: Thu Jul 20, 2023 2:16 am Yes i used your patch code for a template.
No worries.
0x1000 and the other R14 etc was referenced in the original bin i pulled with QH and BE and thought i would try that first to see if i had learned any thing about how it was relevant.
More below.

edit : looking at the reference to R3b i see that it makes sense as it is used more as table output and R34 / R30 probably make more sense also as function registers.
Yes R3B is used as the lookup result. If interrupts were not disabled, a foreground sub could do a lookup and the patch goes pear shaped. Logging a long payload list may take so much time that interrupts may need to be enabled, that would require greater care in selection of scratch registers. One would want to select scratch registers that are only used by background subroutines.

The goal is to select scratch registers for use by the patch code. The patch code requires three scratch registers.
We don't want the patch code to overwrite a scratch register in use by another subroutine.
We don't want another subroutine to overwrite the scratch registers used by patch code.

Looking at your current patch code;
R3B is the high byte of word R3A and also the address mode modifier for R3A.
By choosing to use R3A at 0x8482, 3B must be used at 0x8484.
Opcode 0x46 at 0x8483 is AD3W with address mode options of Indirect or Indirect Auto Increment.
By using the operand value of 0x3B at 0x8484, Indirect Auto Increment address mode is set for word R3A.
The address held by word R3A is increased by 0x02 on each loop.

Looking at the console code, it uses a few registers. It would be fair to say that using the registers the console sub uses, would be a fair bet for the patch code...to an extent.

R14 is being loaded with the contents of a console address. The console can't be plugged in while the QH is on the J3 port. Looking at R14's use throughout the bin it is obvious that it is a scratch register.
RA is a Special Function register, not a scratch register, leave that one alone.
R6 is a Special Function register, not a scratch register, leave that one alone.
R7A is being used with R6, lets leave that alone.
RD is a Special Function register, not a scratch register, leave that one alone.
RE is a Special Function register, not a scratch register, leave that one alone.
R30 is being used as a Rbase by the console sub. Looking at R30's use throughout the bin it is obvious that it is a scratch register.
R42 is being used for the result of the R30+offset by the console sub. Looking at R42 throughout the bin it appears to be a scratch, but is used with an SFR and some timing related code. Without complete disassembly of the bin, I'm not sold on this one.
R1A is being used for the number of data blocks by the console sub. Looking through the bin it is clearly a scratch register.
R1C is being used for the number of tunes by the console sub. Looking through the bin it is clearly a scratch register.

R14, R30, R1A & R1C all look good for use in the patch code, pick 3 out of the 4.

Looking at the console code, it uses two RAM ranges, 0xD00 and 0x1000.
I've seen bins using RAM just above 0x1000 to store parameter data. 3DBC is not disassembled well enough to know if it uses ~0x1000 up for other purposes. Payload offsetting to ~0x1000 as well as logging parameters at ~0x1000 up, just sounds like beta testing the QH and BE.
0xD00 is nominated for console use in the literature, the console can't be plugged in, so it's available to us for QH use as the payload offset.

Code: Select all

   Sub_847e:
847e: fa                  di                     interrupts OFF;
847f: a3,01,00,0d,14      ldw   R14,[R0+d00]     Rcr14 = [d00];            # Scratch and RAM address
8484: 99,2a,15            cmpb  R15,2a                                       
8487: d7,3b               jne   84c4             if (R15 = 2a)  {             
8489: 38,0a,1b            jb    B0,Ra,84a7       if (HSO_OVF = 0)  {       # SFR
848c: 47,01,0e,20,06,7c   ad3w  R7c,R6,[R0+200e] R7c = IO_Timer + [200e];  # SFR
8492: d7,02               jne   8496             if (R7c = 0)  {
8494: 07,7c               incw  R7c              R7c++; }
8496: a0,7c,0e            ldw   Re,R7c           HSI_Time = R7c;           # SFR
8499: b1,0f,0d            ldb   Rd,f             HSO_Cmd = f;              # SFR
849c: c9,a7,84            push  84a7             push(Sub_84a7);
849f: ad,00,30            ldzbw R30,0            wR30 = 0;                 # Scratch
84a2: cb,31,66,84         push  [R30+8466]       push([R30+8466]);
84a6: f0                  ret                    return; }

   Sub_84a7:
84a7: a3,01,80,0c,14      ldw   R14,[R0+c80]     Rcr14 = [c80];
84ac: ad,00,30            ldzbw R30,0            wR30 = 0;
84af: a3,31,78,84,42      ldw   R42,[R30+8478]   R42 = [R30+8478];         # Scratch, but?
84b4: c6,42,00            stb   R0,[R42]         [R42] = 0;
84b7: 36,14,0a            jnb   B6,R14,84c4      if (B6_Rcr14 = 1)  {
84ba: ad,00,30            ldzbw R30,0            wR30 = 0;
84bd: a3,31,72,84,14      ldw   R14,[R30+8472]   Rcr14 = [R30+8472];
84c2: 20,04               sjmp  84c8             goto 84c8; } }



84c4: a1,22,20,14         ldw   R14,2022         Rcr14 = 2022;        
84c8: fb                  ei                     interrupts ON;
84c9: a1,f0,00,18         ldw   R18,f0           R18 = f0;
84cd: b3,01,20,20,1a      ldb   R1a,[R0+2020]    R1a = [2020];             # Scratch
84d2: a2,15,1c            ldw   R1c,[R14++]      R1c = [Rcr14];            # Scratch
84d5: c2,19,1c            stw   R1c,[R18++]      [R18++] = R1c;
84d8: e0,1a,f7            djnz  R1a,84d2         R1a--;
                                                 if (R1a != 0) goto 84d2;
84db: a3,01,00,0d,14      ldw   R14,[R0+d00]     Rcr14 = [d00];
84e0: 99,3b,15            cmpb  R15,3b           
84e3: d7,03               jne   84e8             if (R15 = 3b)  {
84e5: ef,18,8b            call  1000             1000 (); }                # RAM address, but?
84e8: f0                  ret                    return;
I clearly dont understand the code yet and would like help sorting it please.
Ok.

The purpose of the patch code is to copy parameter data from Registers to the MBus.
Registers are inside the microprocessor, not on the MBus.
The QH connects to MBus at the J3 port.

When a register payload is selected for logging, BE must write the patch code to the QH so that the EEC microprocessor can copy the selected register to the datalog offset address.
The list of selected register payload addresses are written by BE to the QH at the payload list address. 0xA000 being chosen in this case. The EEC microprocessor executes the patch code as a background sub, copying the data for the register address stored at 0xA000, to the [register address+datalog offset]. It loops through the payload list until hitting 0x0000 (or 0xFFFF if opcode 0xDA is used at 0x8487).
payload goes further than what i had posted and didnt think that was required in the post.
Ok cool.

This is the patch I would try on 3DBC, with explanatory notes.
You need to edit it into a bin using 0xFF for addresses 0x8498 and 0x8499.
Use your hex editor to to edit addresses 0x8498 and 0x8499 until the file check sum is 0x0000.
Transfer those zero sum values to the definition QH tab patch code for 0x8498 and 0x8499.

Code: Select all

ADDRESS	DATA	
0x847E	0xFA	Disable Interrupts
0x847F	0xA1	Load Word, Payload List Address 0xA000 into R30
0x8480	0x00	
0x8481	0xA0	
0x8482	0x30	
0x8483	0x46	Load Payload Register Address from A000 into R14 with PSW Flags
0x8484	0x31	
0x8485	0x00	
0x8486	0x14	PSW Z Flag set if R14 = 0000. N Flag set if R14 = FFFF
0x8487	0xDA	Jump if Z or N flags set
0x8488	0x0A	
0x8489	0xA2	Load Current Payload Value into R1A from Current Payload Register Address
0x848A	0x14	
0x848B	0x1A	
0x848C	0xC3	Store the [R1A] Payload Value too address [0x0D00 + Payload Register Address] in [R14]
0x848D	0x15	
0x848E	0x00	
0x848F	0x0D	
0x8490	0x1A	
0x8491	0x27	Jump too Loop Start 0x8483
0x8492	0xF0	
0x8493	0xFB	Enable Interrupts
0x8494	0xF0	Return
0x8495	0xFF	Fill
0x8496	0xFF	
0x8497	0xFF	
0x8498	0x??	Patch code
0x8499	0x??	Sum correction
0x849A	0xFF	Fill
0x849B	0xFF	
0x849C	0xFF	
0x849D	0xFF	
0x849E	0xFF	
0x849F	0xFF	
0x84A0	0xFF	
0x84A1	0xFF	
0x84A2	0xFF	
0x84A3	0xFF	
0x84A4	0xFF	
0x84A5	0xFF	
0x84A6	0xFF	
0xA000	0000	Payload List
0xA001	0xFF	Multiple
0xA002	0xFF	Payload Slots
0xA003	0xFF	In Pairs
0xA004	0xFF	
…	0xFF	
…	0xFF	
Crickets on now...see ya

Back again
[edit]
Fixed a typo in the patch
The fill from 0x849A to 0x84A6 is not necessary for the patch to function. It just tidies up the remnants of the console sub. It would make much more sense if at some later time the bin with patch in place is uploaded and disassembled with fill there.
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Fri Jul 21, 2023 7:14 pm

Thank you John for the explanation of the patch code.

I see the relevance of the check sum correction in the patch also.

That makes sense now and will try it when i get a chance on the weekend.

I really appreciate the help and the lessons into the code as the only code i had done was my pin code for credit card.

Jamie
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Mon Jul 24, 2023 2:32 am

I have put data into the QH tab and 0x8498 = 69, 0x8499 = 03,
When i did checksum in hex editor i only calculated the area that we changed.

Plugged in the QH and with key on engine off could data log itps etc.
Started the engine and can data log.

Thank you John for your help.
I really appreciate it very much John.

(i have the 6cyl SD 3DBC running 5.0L v8 in my XH ute test mule that i normally have the 6cyl SD 6DBD_56k in so i can do a base tune for another project that will be 347 v8 )
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Mon Jul 24, 2023 5:32 am

jamie from oz wrote: Mon Jul 24, 2023 2:32 am I have put data into the QH tab and 0x8498 = 69, 0x8499 = 03,
When i did checksum in hex editor i only calculated the area that we changed.
It needs to be for the whole of the checksum range, with the patch edited in. 0x2000 to 0x9FFF.

Glad it worked, though it might be storing a fault code for checksum.

Cool, what is the project?
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Mon Jul 24, 2023 6:47 am

It didn't go into LHM but I will check the codes anyway.
I have a XG Ute that I might build a 347 for and my wife might drive it to work hahaha.

Also have a friend that has a XP wagon with AU 5.0L gt40p head engine that I have a dual plane intake and throttle body injection / tfi dissy for so it looks old school but hopefully starts / drives reliably.
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Sat Aug 12, 2023 6:06 am

Have live tuning working and sorted the data trace also.
I had the rpm-clm and map-word-row etc in the function YPayloadTab and the data trace circle wasn't moving so I tried it without any payloads on the YPayloadTab and works fine now.

Thanks for the help.

I will clean up the xls and post it with a base tune for converting the 6 cylinder eec-iv to run 5.0L windsor and BTR 4 speed auto as Speed Density.
Trans shift points and TV line pressure can be tuned also.

Jamie
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Sat Aug 12, 2023 6:15 am

Cool, I'm interested in the files, thanks..
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Sun Aug 20, 2023 5:52 am

Some other bin files for ETV-512 60 pin EEC-V EL and XH.
6TAA from EL XR6 Tickford.
BE_6TAA_EL_BBM_5speed.BIN
(112 KiB) Downloaded 306 times
6TAC from XH XR6 Tickford ute.
BE_6TAC_XH_BBM_5speed.BIN
(112 KiB) Downloaded 314 times
5TAA from XH XR6 Tickford ute.
BE_5TAA_XH_BBM_5speed.BIN
(112 KiB) Downloaded 314 times
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Sun Aug 20, 2023 5:57 am

5DBC bin for ETV-513 60 pin EEC-V XH Longreach auto and log manifold.
BE_5DBC_XH_Log_auto.BIN
(112 KiB) Downloaded 294 times
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Sun Aug 20, 2023 6:10 am

1DCE ETV-456 EEC-iv
BE_1DCE.BIN
(56 KiB) Downloaded 284 times
1DCD ETV-456 EEC-iv from XG auto ute
BE_1DCD_xgAuto.BIN
(56 KiB) Downloaded 273 times
3DBC ETV-456 EEC-iv std ED 6 cyl
BE_3DBC_6CYL.BIN
(56 KiB) Downloaded 289 times
3DDB ETV-456 EEC-iv std 6 cyl
BE_3DDB.BIN
(56 KiB) Downloaded 290 times
3DBC for 302/5.0 V8 speed density (add exrea injector plug to each bank and made ECT wire longer)
BE_3DBC_forV8_BASE_TUNE.BIN
(56 KiB) Downloaded 266 times
Just made it drivable for now and needs tuning of timing and above 3000rpm
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Sun Aug 20, 2023 7:09 am

Thanks for the bins.
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Sun Jan 21, 2024 9:00 am

Just a question on address R22 in 3DBC
Have i associated the R22=437 for this Sub correctly or am i way off ???
Eg 2459 [R22-49] =3EE ?
245f [R22+27] =45E ?

Code: Select all

   Sub_2445_kam_qualification_test_logic:
2445: a1,37,04,22         ldw   R22,437          R22 = 437_?kam_bit_flags?;
2449: 71,7f,28            an2b  R28,7f           FlgR28_B7_??kamok?? = 0;
244c: b1,aa,42            ldb   R42,aa           R42 = aa;
244f: b1,c6,30            ldb   R30,c6           Scr30 = c6;
2452: b1,75,32            ldb   R32,75           R32 = 75;
2455: 9b,22,b7,42         cmpb  R42,[R22+b7]     
2459: d7,2f               jne   248a             if (R42 = [R22-49])  {            # [r22-49] 437-49=3EE ? kamqa?   LOWEST ADDRESS OF KAM # KAMQA aa= 10101010 BINARY
245b: 9b,22,27,30         cmpb  R30,[R22+27]     
245f: d7,29               jne   248a             if (Scr30 = [R22+27])  {          # [r22+27] 437+27=45E ? kamqb?   MIDDLE ADDRESS OF KAM # KAMQB c6= 11000110 BINARY
2461: 9b,22,50,32         cmpb  R32,[R22+50]     
2465: d7,23               jne   248a             if (R32 = [R22+50])  {            # [r22+50] 437+50=487 ? kamqc?  HIGHEST ADDRESS OF KAM # KAMQC 75= 01110101 BINARY
2467: b1,80,38            ldb   R38,80           R38 = 80;
246a: 9b,22,5a,38         cmpb  R38,[R22+5a]     
246e: d9,1a               jgtu  248a             if (R38 <= [R22+5a])  {           # [r22+5a] 437+5a=491 ? bpptwthi?
2470: 9b,22,52,38         cmpb  R38,[R22+52]     
2474: d9,14               jgtu  248a             if (R38 <= [R22+52])  {           # [r22+52] 437+52=489 ? bpkyon?
2476: 9b,22,51,38         cmpb  R38,[R22+51]     
247a: d9,0e               jgtu  248a             if (R38 <= [R22+51])  {           # [r22+51] 437+51=488 ? bpkam?
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

jsa
Tuning Addict
Posts: 1172
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 3DBC patch code

Post by jsa » Sun Jan 21, 2024 3:58 pm

Looks good 437 is a base value held in R22.

If you do an rbase for 22 over the range of that sub, SAD will calculate and name those indexed addresses.
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

jamie from oz
Regular
Posts: 143
Joined: Wed Oct 06, 2021 5:10 am

Re: 3DBC patch code

Post by jamie from oz » Mon Jan 22, 2024 2:19 am

jsa wrote: Sun Jan 21, 2024 3:58 pm Looks good 437 is a base value held in R22.

If you do an rbase for 22 over the range of that sub, SAD will calculate and name those indexed addresses.
Will give the rbase a try.
Thanks John for your help.
Falcon XH xr6 i6 4.0L ute1995.
Falcon XH v8 5.0L ute 1996 / NVMG84 and 6DGD.bin using sailor bob Def/cry ( ho engine185kw)
Falcon AU2 v8 5.0L ute 2000 / NGVB5 and Y3EE / WALG (factory GT40P heads and intake 200kw )
Falcon EL v8 5.0L with 6cyl SD EEC-V HWAD and 6dbd ETV-513 (JSA'S help with 6dbd_56k_x bin and 6dbd_56k_x Xls)

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests