[jsa]

I loaded them to BE then connected QH and cleared the ram/existing HWAD_E000 tune and uploaded the 56k tune to QH .
when i turned key on it was LHM fuel pump running constant and fans on .
No data when selecting basic or full pid list (probably because of LHM)
it did run about the same as with the 6cyl tune that i started with so there is hope !!!

Read the bin back out of the QH and save it as a different name. Compare the written and read bins to see if they are identical.

Limp home mode, will it spit out fault codes?

6cyl tune you started with? You trying this on an ETV-513 box in a 6cyl EL falcon?

[jamie from oz]

I ran it with the _E000 tune just prior to clearing the ram and loaded the 56k version (didnt touch the QH or eec)

Read the bin back out of the QH and save it as a different name. Compare the written and read bins to see if they are identical.

Yes they are identical when i read out. ( zone identifier error 168 but code is same )

6dbd_56k_x compare msg.jpg

read out 6dbd_56_x.BIN

Limp home mode, will it spit out fault codes?

No cant read the codes with DCR reader.



6cyl tune you started with? You trying this on an ETV-513 box in a 6cyl EL falcon?

Yes 6dbd ETV-513 6cyl el falcon 60 pin eec-v conected to 5.0 V8 (factory looms + 2 x extra injectors 1 on each bank thats all that has been added)

[jsa]

I ran it with the _E000 tune just prior to clearing the ram and loaded the 56k version (didnt touch the QH or eec)

So your _E000 runs, the hardware side should be good in theory.

The E000 is 2 bank sized so QH would be set for multibank mode.
Set the QH for 8 off single bank mode to use the single bank 56k file.

Yes they are identical when i read out. ( zone identifier error 168 but code is same )
6dbd_56k_x compare msg.jpg
read out 6dbd_56_x.BIN

Ok I'll do a compare on that file.

No cant read the codes with DCR reader.

Ok, eec not executing.

Yes 6dbd ETV-513 6cyl el falcon 60 pin eec-v conected to 5.0 V8 (factory looms + 2 x extra injectors 1 on each bank thats all that has been added)

6cyl factory loom not v8 loom.

Are you able to connect just the grounds and twelves to the eec, nothing else...effectively my bench test setup. See if you can the 56k to log like that?

[jamie from oz]

Yes QH and BE automatically in basic mode set to 8 x 56k tunes after i cleared the ram but will do it again to check.

Yes EL 6cyl body loom and EL 6cyl engine loom.

I have a bench loom to check it without the car.

[jamie from oz]

set it up on bench loom and set QH / BE hardware to advanced and set mode2 tunes8 and loaded into position1 .
data logged for 30 odd seconds so i re installed into the car.

when i keyed on it dose its normal 3 second fuel pump cycle and appeared happy .
fired it up on the 6dbd_56k_x tune and it ran and data logged.

put the 6dbd_56k_x_v8 tune in and runs good and data logged.

6dbd_56k_x_v8 2022_Nov_06_17-10-10.csv

Thank you very much John for your work and patience with me.
you need to work out a $$ amount that i can donate to you for your help please

[jsa]

Yes QH and BE automatically in basic mode set to 8 x 56k tunes after i cleared the ram but will do it again to check.

set it up on bench loom and set QH / BE hardware to advanced and set mode2 tunes8 and loaded into position1

Advanced mode... oh yeah, long forgot about that, I must of set it a long time ago and never looked back! Probably never even gave it a chance to set it automatically.

data logged for 30 odd seconds so i re installed into the car.

when i keyed on it dose its normal 3 second fuel pump cycle and appeared happy .
fired it up on the 6dbd_56k_x tune and it ran and data logged.

put the 6dbd_56k_x_v8 tune in and runs good and data logged.

Cool, that's a relief ;)

Thank you very much John for your work and patience with me.
you need to work out a $$ amount that i can donate to you for your help please

You are welcome. Nothing expected.
Many forum members have freely helped me get a start with this stuff.
Pay it forward as they say.

[jamie from oz]

Thank you very much.

[jamie from oz]

John,
Could you have a look at my 6dbd_56k_basic.xls and give me some feedback on why i can't get the yellow data dot to work.

I have put the payload columns into the functions and tables with the payload names.

I am not sure if i have missed something?

Jamie.

(yes i still need to clean it up more as its a mess)

6dbd_56k_basic.xlsx

[jsa]

Ok

[jsa]

Looking at your Functions and Payloads, the definition appears to have appropriate Payload Tags.

Are you enabling Trace with the Home>>Datalog>>Trace button?
Are you selecting the relevant payloads?
Have you tried different values for Width and Radius on the Trace section of the User Preferences dialog?

[jamie from oz]

hi John,

Yes have payloads selected and data logging in datalog.
Yes enabled trace (goes orange around the yellow dot).

The user preference dose change the circle on a >> graphs >> mapping (yes it dose move around with revs) but not able to in a table.

In mapping i can make a data trace with payloads but i was hoping to use it in tables.

in Table >> Map did i have to put Rows / Columns / Value in or should it already be populated Functions in the Table ?

table mapping BE.jpg

[jsa]

Jamie,

Looking at FN1320 in your Def, I see you have N as the X payload.
I think that should be rpm_2, your column scaler.

[jamie from oz]

Thanks.
I will try that and recheck the others.

[jamie from oz]

JSA i wonder if you could help disassemble this part of the 6dbd_56k_x please.

Code: Select all

e33a -> e361 = 0x0  ## fill ## 

e362: af,a2,00,00,00,00,57,57,00,00,00,00,57,4b,00,00  ???  
e372: 00,00,00,00,00,00,00,00,af,96,00,00,00,00,3e,3e  ???  
e382: 00,00,57,64,00,00,00,00,00,00,00,00,af,96,57,57  ???  
e392: 00,00,39,52,00,00,af,96,8a,7d,71,71,71,71,32,32  ???  
e3a2: 32,00,71,64,4b,3f,3f,32,1e,14,32,32,32,3f,32,3f  ???  
e3b2: 7d,71,44,4b,00,00,58,5d,26,00,3a,32,26,0d,64,4b  ???  
e3c2: 26,26,71,71,7d,71,32,32,32,32,19,19,32,3f,83,71  ???  
e3d2: 77,7b,53,53,58,58,6a,6a,6a,19,5e,4b,64,5e,7c,7c  ???  
e3e2: 8a,7c,51,51,51,71,51,77,70,71,64,77,19,19,42,5e  ???  
e3f2: 19,19,6e,7c,7c,19,7d,57,7d,64,1f,19,70,71,6a,6a  ???  
e402: 51,51,6a,6a,51,77,6b,71,62,5e,53,53,58,58,4b,5e  ???  
e412: 4b,19,38,41,51,51,64,64,8a,7c,45,4b,45,6a,4b,73  ???  
e422: 49,4b,5e,71,19,19,3a,4f,19,19,53,71,7c,19,70,3e  ???  
e432: 64,7d,25,1f,49,4b   ???   

e438: 4b                  byte     4b

e439: 5e,45,4b,6a,6a,4b,73,4c,4b,00,00,3f,3f,3f,3f,0d  ???  
e449: 0d,0d,00,13,30,19,19,0d,0a,0f,00,00,00,00,00,00  ???  
e459: 00,00,00,19,19,00,00,58,3f,00,00,0d,13,00,00,ef  ???  
e469: da,00,00,7d,7d,00,00,0d,0d,00,00,0d,19,00,00,fe  ???  
e479: 00,00,fb,32,32,32,32,26,26,26,00,20,30,19,19,26  ???  
e489: 26,0a,00,00,00,00,00,00,f3,f3,ed,26,19,00,00,3f  ???  
e499: 50,00,00,19,00,3f,3f,e1,da,00,00,7d,3f,f3,ed,26  ???  
e4a9: 26,00,00,0d,19,00,f3,f3,ed,d5,d3,ce,c1,ce,c1,19  ???  
e4b9: 19,19,00,e7,ee,d8,da,05,0a,0a,00,da,da,da,ce,da  ???  
e4c9: f3,ec,e7,19,19,00,00,26,12,00,00,1e,0d,00,00,cc  ???  
e4d9: c2,00,00,b5,ce,ec,e7,19,19,da,da,0d,19,da,f3,e2  ???  
e4e9: e7,c1,d0,83,83,83,83,32,32,32,00,c4,e4,b5,da,19  ???  
e4f9: 19,00,00,ce,ce,ce,c1,ce,e7,ce,ce,26,19,00,00,4b  ???  
e509: 13,00,00,3f,19,00,00,c2,c2,00,00,9c,b5,ce,ce,32  ???  
e519: 32,ce,ce,0d,19,ce,e7,ce,ce,05,03,00,00,00,00,0f  ???  
e529: 0f,0f,00,f8,00,ee,ee,0a,0a,00,00,f1,e7,f1,f1,e2  ???  
e539: e2,f8,00,00,00,00,00,f6,f6,00,00,f8,f6,00,00,00  ???  
e549: fb,00,00,03,fb,f8,00,0f,0f,f1,e7,0d,0d,e2,e2,0a  ???  
e559: 00                  ???   

[jsa]

Yes, I'll have a look at it.
Straight up from your code sample, I see a 6 byte pattern, I'd throw a 6 byte struct in DIR over the range before the byte, just to see what that looks like.

[jsa]

Jamie,

So I've done a little digging. The 6 byte pattern did not look to be anything familiar to me. If it were a table then all the lookup subs need to be correct so SAD discovers any that may exist in that area.

So I reviewed the lookups and commanded some changes as SAD had some errors and missed some.
LST

Code: Select all

##### Entry Point for Reg Input, Signed Input Unsigned Output
   SLU355F_RSUYFn:
355f: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;                     # B5 Set 1 For Signed Input
3562: 20,34               sjmp  3598             goto SLU3598_RUUYFn;


##### Entry Point for Reg Input, Signed Input Signed Output
   SLU3564_RSSYFn:
3564: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;                     # B5 Set 1 For Signed Input
    # Cont  from L3564 Signed Input Lookup                                         SLU3564_RSSYFn

##### Entry Point for Reg Input, Unsigned Input Signed Output
   SLU3567_RUSYFn:
3567: 91,10,e0            orb   Re0,10           SIGNDY = 1;                       # B4 Set 1 For Signed Output
    # Cont  from L3567 Signed Output Lookup                                        SLU3567_RUSYFn
356a: 20,2c               sjmp  3598             goto SLU3598_RUUYFn;


##### Entry Point for Arg Input, Signed Input Unsigned Output
   SLU356C_ASUYFn:
356c: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;                     # B5 Set 1 For Signed Input
356f: 20,06               sjmp  3577             goto SLU3577_AUUYFn;


##### Entry Point for Arg Input, Signed Input Signed Output
   SLU3571_ASSYFn:
3571: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;                     # B5 Set 1 For Signed Input
    # Cont  from L3571 Signed Input Lookup                                         SLU3571_ASSYFn

##### Entry Point for Arg Input, Unsigned Input Signed Output
   SLU3574_AUSYFn:
3574: 91,10,e0            orb   Re0,10           SIGNDY = 1;                       # B4 Set 1 For Signed Output
    # Cont  from L3574 Signed Output Lookup                                        SLU3574_AUSYFn

##### Entry Point for Arg Input, Unsigned Input Unsigned Output
   SLU3577_AUUYFn:
3577: cc,3e               pop   R3e              R3e = pop();
3579: b2,3f,3a            ldb   R3a,[R3e++]      R3a = [R3e++];
357c: b2,3f,3b            ldb   R3b,[R3e++]      R3b = [R3e++];
357f: ac,3b,3c            ldzbw R3c,R3b          wR3c = yR3b;
3582: 71,0f,3b            an2b  R3b,f            R3b &= f;
3585: 08,04,3c            shrw  R3c,4            R3c >>= 4;
3588: 67,3d,f0,00,3a      ad2w  R3a,[R3c+f0]     R3a += [R3c+f0];
358d: b2,3f,3c            ldb   R3c,[R3e++]      R3c = [R3e++];
3590: b2,3f,3d            ldb   R3d,[R3e++]      R3d = [R3e++];
3593: c8,3e               push  R3e              push(R3e);
3595: b2,3c,3c            ldb   R3c,[R3c]        R3c = [R3c];

##### Entry Point for Reg Input, Unsigned Input Unsigned Output
   SLU3598_RUUYFn:
3598: 9b,3a,02,3c         cmpb  R3c,[R3a+2]      
359c: 3d,e0,04            jb    B5,Re0,35a3      if (SIGNDSLP = 0)  {
359f: db,0a               jc    35ab             if (R3c >= [R3a+2]) goto 35ab;
35a1: 20,02               sjmp  35a5             goto 35a5; }

35a3: d6,06               jge   35ab             if (R3c < [R3a+2])  {
35a5: 65,02,00,3a         ad2w  R3a,2            R3a += 2;
35a9: 27,ed               sjmp  3598             goto SLU3598_RUUYFn; } }

35ab: 71,df,e0            an2b  Re0,df           SIGNDSLP = 0;
35ae: b2,3b,3e            ldb   R3e,[R3a++]      R3e = [R3a++];
35b1: b2,3b,40            ldb   R40,[R3a++]      R40 = [R3a++];
35b4: 7a,3a,3e            sb2b  R3e,[R3a]        R3e -= [R3a];
35b7: 7a,3b,3c            sb2b  R3c,[R3a++]      R3c -= [R3a++];
35ba: 7a,3a,40            sb2b  R40,[R3a]        R40 -= [R3a];
35bd: 3c,e0,04            jb    B4,Re0,35c4      if (SIGNDY = 0)  {
35c0: db,09               jc    35cb             if (R40 >= 0) goto 35cb;
35c2: 20,02               sjmp  35c6             goto 35c6; }

35c4: d6,05               jge   35cb             if (R40 < 0)  {
35c6: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
35c9: 13,40               negb  R40              R40 = -R40; } }
35cb: 7c,3c,40            ml2b  R40,R3c          wR40 *= R3c;
35ce: 9c,3e,40            divb  R40,R3e          yR40 /= R3e;
35d1: 35,e0,02            jnb   B5,Re0,35d6      if (SIGNDSLP = 1)  {
35d4: 13,40               negb  R40              R40 = -R40; }
35d6: 76,3a,40            ad2b  R40,[R3a]        R40 += [R3a];
35d9: 11,41               clrb  R41              R41 = 0;
35db: 71,cf,e0            an2b  Re0,cf           SIGNDY = 0;
                                                 SIGNDSLP = 0;
35de: f0                  ret                    return;

   SLU35DF_RSUWFn:
35df: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
35e2: 20,34               sjmp  3618             goto SLU3618_RUUWFn;

   SLU35E4_RSSWFn:
35e4: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
   SLU35E7_RUSWFn:
35e7: 91,10,e0            orb   Re0,10           SIGNDY = 1;
35ea: 20,2c               sjmp  3618             goto SLU3618_RUUWFn;

   SLU35EC_ASUWFn:
35ec: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
35ef: 20,06               sjmp  35f7             goto SLU35F7_AUUWFn;

   SLU35F1_ASSWFn:
35f1: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
   SLU35F4_AUSWFn:
35f4: 91,10,e0            orb   Re0,10           SIGNDY = 1;
   SLU35F7_AUUWFn:
35f7: cc,3e               pop   R3e              R3e = pop();
35f9: b2,3f,3a            ldb   R3a,[R3e++]      R3a = [R3e++];
35fc: b2,3f,3b            ldb   R3b,[R3e++]      R3b = [R3e++];
35ff: ac,3b,3c            ldzbw R3c,R3b          wR3c = yR3b;
3602: 71,0f,3b            an2b  R3b,f            R3b &= f;
3605: 08,04,3c            shrw  R3c,4            R3c >>= 4;
3608: 67,3d,f0,00,3a      ad2w  R3a,[R3c+f0]     R3a += [R3c+f0];
360d: b2,3f,3c            ldb   R3c,[R3e++]      R3c = [R3e++];
3610: b2,3f,3d            ldb   R3d,[R3e++]      R3d = [R3e++];
3613: c8,3e               push  R3e              push(R3e);
3615: a2,3c,3c            ldw   R3c,[R3c]        R3c = [R3c];
   SLU3618_RUUWFn:
3618: 8b,3a,04,3c         cmpw  R3c,[R3a+4]      
361c: 3d,e0,04            jb    B5,Re0,3623      if (SIGNDSLP = 0)  {
361f: db,0a               jc    362b             if (R3c >= [R3a+4]) goto 362b;
3621: 20,02               sjmp  3625             goto 3625; }

3623: d6,06               jge   362b             if (R3c < [R3a+4])  {
3625: 65,04,00,3a         ad2w  R3a,4            R3a += 4;
3629: 27,ed               sjmp  3618             goto SLU3618_RUUWFn; } }

362b: 71,df,e0            an2b  Re0,df           SIGNDSLP = 0;
362e: a2,3b,3e            ldw   R3e,[R3a++]      R3e = [R3a++];
3631: a2,3b,40            ldw   R40,[R3a++]      R40 = [R3a++];
3634: 6a,3a,3e            sb2w  R3e,[R3a]        R3e -= [R3a];
3637: 6a,3b,3c            sb2w  R3c,[R3a++]      R3c -= [R3a++];
363a: 6a,3a,40            sb2w  R40,[R3a]        R40 -= [R3a];
363d: 3c,e0,04            jb    B4,Re0,3644      if (SIGNDY = 0)  {
3640: db,09               jc    364b             if (R40 >= 0) goto 364b;
3642: 20,02               sjmp  3646             goto 3646; }

3644: d6,05               jge   364b             if (R40 < 0)  {
3646: 91,20,e0            orb   Re0,20           SIGNDSLP = 1;
3649: 03,40               negw  R40              R40 = -R40; } }
364b: 6c,3c,40            ml2w  R40,R3c          lR40 *= R3c;
364e: 8c,3e,40            divw  R40,R3e          wR40 /= R3e;
3651: 35,e0,02            jnb   B5,Re0,3656      if (SIGNDSLP = 1)  {
3654: 03,40               negw  R40              R40 = -R40; }
3656: 66,3a,40            ad2w  R40,[R3a]        R40 += [R3a];
3659: 71,cf,e0            an2b  Re0,cf           SIGNDY = 0;
                                                 SIGNDSLP = 0;
365c: f0                  ret                    return;
.
.
   SLU3783_WSYTb:
3774: 91,08,e0            orb   Re0,8            TblSflg = 1;
   SLU3786_WUYTb:
3777: 5c,3b,3c,3e         ml3b  R3e,R3c,R3b      wR3e = yR3c * R3b;
377b: 74,39,3e            ad2b  R3e,R39          R3e += R39;
377e: d3,02               jnc   3782             if (R3e > ff)  {
3780: 17,3f               incb  R3f              R3f++; }
3782: 64,3e,40            ad2w  R40,R3e          R40 += R3e;
3785: b2,41,39            ldb   R39,[R40++]      R39 = [R40++];
3788: b2,40,3b            ldb   R3b,[R40]        R3b = [R40];
378b: 28,1f               scall 37ac             SLU37AC_yTb.Intrplt ();
378d: 64,3c,40            ad2w  R40,R3c          R40 += R3c;
3790: b2,40,3b            ldb   R3b,[R40]        R3b = [R40];
3793: 05,40               decw  R40              R40--;
3795: b2,40,39            ldb   R39,[R40]        R39 = [R40];
3798: b0,43,3c            ldb   R3c,R43          R3c = R43;
379b: 28,0f               scall 37ac             SLU37AC_yTb.Intrplt ();
379d: b0,43,3b            ldb   R3b,R43          R3b = R43;
37a0: b0,3c,39            ldb   R39,R3c          R39 = R3c;
37a3: b0,3a,38            ldb   R38,R3a          R38 = R3a;
37a6: 28,04               scall 37ac             SLU37AC_yTb.Intrplt ();
37a8: 71,f7,e0            an2b  Re0,f7           TblSflg = 0;
37ab: f0                  ret                    return;

   SLU37AC_yTb.Intrplt:
37ac: 3b,e0,13            jb    B3,Re0,37c2      if (TblSflg = 0)  {
37af: 5c,3b,38,42         ml3b  R42,R38,R3b      wR42 = yR38 * R3b;
37b3: 5c,39,38,3e         ml3b  R3e,R38,R39      wR3e = yR38 * R39;
37b7: 68,3e,42            sb2w  R42,R3e          R42 -= R3e;
37ba: 74,39,43            ad2b  R43,R39          R43 += R39;
37bd: 65,80,00,42         ad2w  R42,80           R42 += 80;
37c1: f0                  ret                    return; }

37c2: 71,fb,e0            an2b  Re0,fb           B2_RE0_Flags = 0;
37c5: 98,39,3b            cmpb  R3b,R39          
37c8: de,06               jlt   37d0             if (R3b >= R39)  {
37ca: 58,39,3b,42         sb3b  R42,R3b,R39      R42 = R3b - R39;
37ce: 20,07               sjmp  37d7             goto 37d7; }

37d0: 91,04,e0            orb   Re0,4            B2_RE0_Flags = 1;
37d3: 58,3b,39,42         sb3b  R42,R39,R3b      R42 = R39 - R3b;
37d7: 7c,38,42            ml2b  R42,R38          wR42 *= R38;
37da: 3a,e0,04            jb    B2,Re0,37e1      if (B2_RE0_Flags = 0)  {
37dd: 74,39,43            ad2b  R43,R39          R43 += R39;
37e0: f0                  ret                    return; }

37e1: 58,43,39,43         sb3b  R43,R39,R43      R43 = R39 - R43;
37e5: f0                  ret                    return;

37e6: b3,64,93,26         ldb   R26,[R64+93]     R26scr = [413];
37ea: b3,64,a6,27         ldb   R27,[R64+a6]     R27 = [426];
37ee: b3,64,a7,28         ldb   R28,[R64+a7]     R28 = [427];
37f2: 9b,f8,10,26         cmpb  R26,[Rf8+10]     
37f6: de,04               jlt   37fc             if (R26scr >= [cc94])  {
37f8: 9a,38,27            cmpb  R27,[R38]        
37fb: f0                  ret                    return; }

37fc: 9b,f8,11,26         cmpb  R26,[Rf8+11]     
3800: da,0b               jle   380d             if (R26scr > [cc95])  {
3802: 9b,38,01,27         cmpb  R27,[R38+1]      
3806: d3,04               jnc   380c             if (R27 >= [R38+1])  {
3808: 9b,38,02,28         cmpb  R28,[R38+2]       }
380c: f0                  ret                    return; }

380d: 9b,38,03,27         cmpb  R27,[R38+3]      
3811: d3,04               jnc   3817             if (R27 >= [R38+3])  {
3813: 9b,38,04,28         cmpb  R28,[R38+4]       }
3817: f0                  ret                    return;

DIR

Code: Select all

SYM  E0 "RE0_Flags"                   #UY # 
SYM   E0 "TblSflg"                    :B3 # Table Output, Conrtrol Value, is signed
SYM   E0 "SIGNDY"                     :B4 # Output, Control Value, Signed when set before Fn Call
SYM   E0 "SIGNDSLP"                   :B5 # Output, Control Value, Increases by Row in Fn
SYM   E0 "SIGNDX"                     :B5 # Input, Process Value, Signed if set before Fn Call
#                                         # or Output, Control Value, Increases by Row in Fn
#                                         # or Input, Process Value, Signed if set before Fn Call

SCA 3564
SCA 3571
SCA 35F1
SCA 365D
SCA 3664
SCA 368F

##### Function Lookup Subroutines: R3A Fn_Addr Reg, R3C Input Reg, R40 output Reg
SUB 355F "SLU355F_RSUYFn"    $F suyflu 3A                 # Reg Inputs, Signed In, Unsigned Out
SUB 3564 "SLU3564_RSSYFn"    $F ssyflu 3A                 # Reg Inputs, Signed In, Signed Out
SUB 3567 "SLU3567_RUSYFn"    $F usyflu 3A                 # Reg Inputs, Unsigned In, Signed Out

SUB 356C "SLU356C_ASUYFn"    $F suyflu 3A :E2 F0 N :WN    # Arg Inputs, Signed In, Unsigned Out
SUB 3571 "SLU3571_ASSYFn"    $F ssyflu 3A :E2 F0 N :WN    # Arg Inputs, Signed In, Signed Out
SUB 3574 "SLU3574_AUSYFn"    $F usyflu 3A :E2 F0 N :WN    # Arg Inputs, Unsigned In, Signed Out

SUB 3577 "SLU3577_AUUYFn"    $F uuyflu 3A :E2 F0 N :WN    # Arg Inputs, Unsigned In, Unsigned Out

SUB 3598 "SLU3598_RUUYFn"    $F uuyflu 3A                 # Reg Inputs, Unsigned In, UnSigned Out

SUB 35DF "SLU35DF_RSUWFn"    $F suwflu 3A                 # Reg Inputs, Signed In, Unsigned Out
SUB 35E4 "SLU35E4_RSSWFn"    $F sswflu 3A                 # Reg Inputs, Signed In, Signed Out
SUB 35E7 "SLU35E7_RUSWFn"    $F uswflu 3A                 # Reg Inputs, Unsigned In, Signed Out

SUB 35EC "SLU35EC_ASUWFn"    $F suwflu 3A :E2 F0 N :WN    # Arg Inputs, Signed In, Unsigned Out
SUB 35F1 "SLU35F1_ASSWFn"    $F sswflu 3A :E2 F0 N :WN    # Arg Inputs, Signed In, Signed Out
SUB 35F4 "SLU35F4_AUSWFn"    $F uswflu 3A :E2 F0 N :WN    # Arg Inputs, Unsigned In, Signed Out

SUB 35F7 "SLU35F7_AUUWFn"    $F uuwflu 3A :E2 F0 N :WN    # Arg Inputs, Unsigned In, Unsigned Out

SUB 3618 "SLU3618_RUUWFn"    $F uuwflu 3A                 # Reg Inputs, Unsigned In, UnSigned Out

##### Table Lookup Subroutines: R40 Tb_Addr Reg, R38 Column Input Reg, R3A Row Input Reg
#####                           R3C Column Quantity Input Reg, R43 Output Reg
SUB 3774 "SLU3783_WSYTb"     $F sytlu 40 3C               # Word Inputs, Signed Byte Out
SUB 3777 "SLU3786_WUYTb"     $F uytlu 40 3C               # Word Inputs, Unsigned Byte Out
#
SUB 37AC "SLU37AC_yTb.Intrplt"                            # Interpolate 4 byte cells to find Control Value

CMT

Code: Select all

355E \n\n##### Entry Point for Reg Input, Signed Input Unsigned Output
355F # B5 Set 1 For Signed Input

3563 \n\n##### Entry Point for Reg Input, Signed Input Signed Output
3564 # B5 Set 1 For Signed Input

3566   \n    # Cont  from L3564 Signed Input Lookup \t83\s3564

3566 \n\n##### Entry Point for Reg Input, Unsigned Input Signed Output
3567 # B4 Set 1 For Signed Output

3569   \n    # Cont  from L3567 Signed Output Lookup \t83\s3567

356B \n\n##### Entry Point for Arg Input, Signed Input Unsigned Output
356C # B5 Set 1 For Signed Input

3570 \n\n##### Entry Point for Arg Input, Signed Input Signed Output
3571 # B5 Set 1 For Signed Input

3573   \n    # Cont  from L3571 Signed Input Lookup \t83\s3571

3573 \n\n##### Entry Point for Arg Input, Unsigned Input Signed Output
3574 # B4 Set 1 For Signed Output

3576   \n    # Cont  from L3574 Signed Output Lookup \t83\s3574

3576 \n\n##### Entry Point for Arg Input, Unsigned Input Unsigned Output

3597 \n\n##### Entry Point for Reg Input, Unsigned Input Unsigned Output

The above did not change anything around 0xE362, such is disassembly.

Some possibilities come to mind;
* The data is not actually used in this strategy, so it won't be looked up.
* The data could be accessed as part of a loop, so one address such as a byte is the start of the loop series.
* The data could be accessed by encoded arguments to a subroutine sequence.

All of that takes time to unravel. How much have you added to your DIR?

More in the next post.

[jsa]

Jamie,

This subroutine has encoded arguments. I'm expecting the arg 1's to be S.ECTMIN_0.2V and S.ECTMAX_4.675V.
SAD often gets the Arg size wrong and possibly the count. It is necessary to work through the code to confirm the correct details.

Code: Select all

   SubA264_iECT_iMAP_Test:
a264: b0,38,3a            ldb   R3a,R38          R3a = R38;
a267: 28,f7               scall a360             SubA360_6Args_To_R2A... (
a269: 4e,90                     #arg 1              904e,                                     # Encoded address
a26b: 46,04                     #arg 2              iECT,
a26d: 17,01                     #arg 3              117 );
a26f: 28,ef               scall a360             SubA360_6Args_To_R2A... (
a271: 46,04                     #arg 1              iECT,
a273: 50,90                     #arg 2              9050,                                     # Encoded address
a275: 18,01                     #arg 3              118 );
.
.
.
##################################################################################
# Take 6 Args from calling Subr and store to R2A - R2F

    # SCall from LA267                                                             SubA264_iECT_iMAP_Test  # B1 Clear 0
   SubA360_6Args_To_R2A...:
a360: 2e,33               scall a195             SubA195_xArgs_To_R2A... (
a362: 06                        #arg 1              6 );
a363: 28,1a               scall a37f             Sub_a37f (
a365: 2a,00                     #arg 1              R2Ascr );
a367: 28,16               scall a37f             Sub_a37f (
a369: 2c,00                     #arg 1              R2Cscr );
a36b: a2,2a,4a            ldw   R4a,[R2a]        R4Ascr = [R2Ascr];
a36e: 8a,2c,4a            cmpw  R4a,[R2c]        
a371: d1,08               jleu  a37b             if (R4Ascr > [R2Cscr])  {
a373: 3e,80,08            jb    B6,R80,a37e      if (B6_R80 = 1) return;
a376: a0,2e,2a            ldw   R2a,R2e          R2Ascr = R2e;
a379: 2a,f8               scall a673             Sub_a673 (); }
a37b: 71,bf,80            an2b  R80,bf           B6_R80 = 0; }
a37e: f0                  ret                    return;
.
.
.
##################################################################################
#  Args from L....
#
# Transfers arguments from the master caller to R2A
# The subcaller has an argument for the master caller byte count
# SubA199 is an entry point for an alternate target register series


    # SCall from LA360 to transfer 6 args to R2A                                   SubA360_6Args_To_R2A...
 
   SubA195_xArgs_To_R2A...:
a195: a1,2a,00,26         ldw   R26,2a           R26scr = 2a;                      # R2A start of argument series
   Sub_a199:
a199: cc,44               pop   R44              R44 = pop();                      # Receives caller address from stack
a19b: b2,45,42            ldb   R42,[R44++]      R42 = [R44++];                    # Receives caller argument byte
a19e: cc,4a               pop   R4a              R4Ascr = pop();                   # Receives master caller address from stack

    # DJNZ  Loop from LA1A6 until argument byte count depleted                     SubA195_xArgs_To_R2A...
a1a0: b2,4b,43            ldb   R43,[R4a++]      R43 = [R4Ascr];                   # Pass 1 receive master caller argument byte 1
                                                                                   # Pass 2 receive master caller argument byte 2
                                                                                   # repeat for argument byte count held in R42
a1a3: c6,27,43            stb   R43,[R26++]      [R26scr] = R43;                   # Pass 1 R2A stores master caller byte 1
                                                                                   # Pass 2 R2B stores master caller byte 2
                                                                                   # repeat for argument byte count held in R42
a1a6: e0,42,f7            djnz  R42,a1a0         R42--;
                                                 if (R42 != 0) goto a1a0;          # Loop until argument byte count depleted

a1a9: c8,4a               push  R4a              push(R4Ascr);                     # Place master caller return address on stack
a1ab: c8,44               push  R44              push(R44);                        # Place caller return address on stack
a1ad: f0                  ret                    return;
.
.
.
   Sub_a37f:
a37f: a1,46,00,26         ldw   R26,46           R26scr = 46;
a383: 2e,14               scall a199             Sub_a199 (
a385: 02                        #arg 1              2 );
a386: a2,46,4a            ldw   R4a,[R46]        R4Ascr = [R46];
a389: 37,4b,11            jnb   B7,R4b,a39d      if (B7_R4b = 1)  {
a38c: ac,4b,42            ldzbw R42,R4b          wR42 = yR4b;
a38f: 71,0f,4b            an2b  R4b,f            R4b &= f;
a392: 08,03,42            shrw  R42,3            R42 >>= 3;
a395: 67,43,e0,00,4a      ad2w  R4a,[R42+e0]     R4Ascr += [R42+e0];
a39a: c2,46,4a            stw   R4a,[R46]        [R46] = R4Ascr; }
a39d: f0                  ret                    return;

I'm out of time right now and have not checked through it in detail, so it may need some further revision. I've thrown some mud at the wall, see what you think sticks. Do you think the arg sizes and counts are correct? Can you decode the target address's for the two scalars?

[jamie from oz]

Thanks John.

I will check if I have any of the entries in my Dir and if I have any of the other code resolved as I did add some Sub's to get some code resolved but will check and post my Dir and progress.

Jamie.

[jamie from oz]

I have added the entries to my Dir and will look through it when i can to see the changes.

6dbd_56k_x_DIR.txt

[jsa]

Ok, probably be the weekend before I get a chance to do more on it.

[jamie from oz]

John,
I am not seeing a relevant address at those just embedded in a row of code.

Code: Select all

9038: 9b,f8,42,00         cmpb  R0,[Rf8+42]      
903c: df,09               je    9047             if (?manual_trans_sw_?isc/dpot != ZERO)  {
903e: a1,02,00,3a         ldw   R3a,2            R3a = 2;
9042: 33,80,02            jnb   B3,R80,9047      if (B3_R80 = 1)  {
9045: 07,3a               incw  R3a              R3a++; } }
9047: 9b,f6,40,00         cmpb  R0,[Rf6+40]      
904b: df,04               je    9051             if ([c88a] != ZERO)  {
904d: 61,fe,ff,3a         an2w  R3a,fffe         B0_R3a = 0; }
9051: c7,6c,9e,3a         stb   R3a,[R6c+9e]     [7ee] = R3a;
9055: 09,01,3a            shlw  R3a,1            R3a <<= 1;
9058: a3,3b,ce,08,44      ldw   R44,[R3a+8ce]    R44 = [R3a+8ce];
905d: 0a,01,44            asrw  R44,1            swR44 >>= 1; }
9060: a3,64,90,3c         ldw   R3c,[R64+90]     R3c = 410_N;
9064: 45,40,02,f6,3a      ad3w  R3a,Rf6,240      R3a = ca8a;
9069: 3e,72,05            jb    B6,R72,9071      if (B6_R72 = 0)  {
906c: 45,5c,02,f6,3a      ad3w  R3a,Rf6,25c      R3a = caa6; }
9071: ef,a4,a5            call  3618             SLU3618_RUUWFn ();
9074: c0,24,40            stw   R40,R24          R24scr = R40;
9077: 45,c8,03,f6,3a      ad3w  R3a,Rf6,3c8      R3a = cc12;
907c: bf,64,94,3c         ldsbw R3c,[R64+94]     swR3c = 414_ECT;

I updated some entries in Dir.

6dbd_56k_x_DIR.txt

[jsa]

Jamie,

Thanks for the updated DIR
904E is not the actual address. The actual address gets decoded from 904E.
I'll do a detailed decode and post it up.

Code: Select all

a269: 4e,90                     #arg 1              904e,                                     # Encoded address

[jamie from oz]

John
I'm not sure if this is relevant.
Fault code 116 is coolant temp out of range.
Fault code 117 is coolant sensor voltage low.
Fault code 118 coolant sensor voltage high.

[jamie from oz]

Have added a link to Ti performance.
https://www.tiperformance.com.au/knowle ... tic-codes/

[jamie from oz]

So that makes some sense to me.
Structure at 9B16 is fault code list.

[jamie from oz]

How can i make the Args display as words not bytes ?

a450 a451 look like should be 0791 that would make it error code 791 = cooling fan relay no 1 fault.

Code: Select all

##### Fault Tests KOER Tests not displayed correctly ######
   Sub_a441_Args_not_displayed_correctly:
a441: 91,40,85            orb   R85,40           B6_R85 = 1;
a444: 29,27               scall a56d             Sub_a56d ();
a446: 29,08               scall a550             Sub_a550 ();
a448: 28,bf               scall a509             Sub_a509 (
a44a: 58,90                     #arg 1              9058,
a44c: 42,04                     #arg 2              442,
a44e: 00                        #arg 3              0,
a44f: 05                        #arg 4              5,
a450: 91                        #arg 5              91,
a451: 07                        #arg 6              7 );
a452: 28,b5               scall a509             Sub_a509 (
a454: 5a,90                     #arg 1              905a,
a456: 42,04                     #arg 2              442,
a458: 00                        #arg 3              0,
a459: 06                        #arg 4              6,
a45a: 92                        #arg 5              92,
a45b: 07                        #arg 6              7 );
a45c: 28,ab               scall a509             Sub_a509 (

[jsa]

John
I'm not sure if this is relevant.
Fault code 116 is coolant temp out of range.
Fault code 117 is coolant sensor voltage low.
Fault code 118 coolant sensor voltage high.

Have added a link to Ti performance.
https://www.tiperformance.com.au/knowle ... tic-codes/

So that makes some sense to me.
Structure at 9B16 is fault code list.

The strategy files on github/openeec also have Fault code info.

Wonder why that struct ended up in DIR so early on...
Take it one step further and you will be able to work backwards from the fault codes to positively ID scalars and pids.
...what was that about ECTMIN/MAX a couple posts back...

[jsa]

Jamie,

So SAD has sorted the arg size on this one but does not have the encoding type covered. It is an encoding type that will be added in some future SAD release. So it has to be done manually as an interim measure.

In a previous post I pasted in all the subs and some comments relating too the decode for this sub's args.

The attached spreadsheet is the code layed out in execution order with the relevant content of the stack and registers in order. It covers just the first 6 bytes of args.

Address decode A264 6DBX.xlsx

I've decoded one Subs worth, 904E to 9050...add 2 bytes...C3C4...you get the idea.
You should now be able to manually unencode all encoded args that use SubA37F.
Ask away if more/better explanation is required.

Code: Select all

#
##################################################################################
# Test ECT and MAP inputs
   SubA264_iECT_iMAP_Test:
a264: b0,38,3a            ldb   R3a,R38          R3a = R38;
a267: 28,f7               scall a360             SubA360_6Args_To_R2A... (         # Master Caller next address placed on stack
a269: 4e,90                     #arg 1              904e,                          # R2A,R2B Encoded address
                                                                                   # [C3C2] S.ECTMIN_0.2V
a26b: 46,04                     #arg 2              iECT,                          # R2C,R2D Hi Byte Bit 7 not set, so unencoded
a26d: 17,01                     #arg 3              117 );                         # R2E,R2F Fault code
a26f: 28,ef               scall a360             SubA360_6Args_To_R2A... (
a271: 46,04                     #arg 1              iECT,                          # Hi Byte Bit 7 not set, so unencoded
a273: 50,90                     #arg 2              9050,                          # Hi Byte Bit 7 set 1, so encoded
                                                                                   # [C3C4] S.ECTMAX_4.675V
a275: 18,01                     #arg 3              118 );                         # Fault code
a277: 98,38,3a            cmpb  R3a,R38          
a27a: d7,0b               jne   a287             if (R3a = R38)  {
a27c: ef,04,04            call  a683             Sub_a683 (
a27f: 46,04                     #arg 1              iECT,
a281: 72,90                     #arg 2              9072,                          # [C3E6] S.VIECT2_0.315V
a283: 74,90                     #arg 3              9074,                          # [C3E8] S.VIECT1_3.585V
a285: 16,01                     #arg 4              116 ); }
a287: a3,66,b6,4a         ldw   R4a,[R66+b6]     R4Ascr = MAPTMR;                  # [0536]
a28b: 8b,f3,88,00,4a      cmpw  R4a,[Rf2+88]     
a290: d1,06               jleu  a298             if (R4Ascr > [c3fc])  {
a292: 2b,db               scall a66f             Sub_a66f (
a294: 26,01                     #arg 1              126 );
a296: 20,0b               sjmp  a2a3             goto a2a3; }

a298: ef,e8,03            call  a683             Sub_a683 (
a29b: 2e,05                     #arg 1              MAPTIM_Dt,                     # [052E]
a29d: 7c,90                     #arg 2              907c,                          # [C3F0] S.VBPDL1
a29f: 7e,90                     #arg 3              907e,                          # [C3F2] S.VBPDL2
a2a1: 26,01                     #arg 4              126 );
a2a3: c7,64,79,00         stb   R0,[R64+79]      [4f9] = ZERO;
a2a7: 17,40               incb  R40              R40++;
a2a9: f0                  ret                    return;

I've added some stuff to your DIR;

6dbd_56k_x_DIR.txt

This is my CMT, rename it to suit or combine with your own;

6dbx_CMT.txt

One or more :UW or :SW option/s added to the Sub command will force arg size. It is covered in the SAD help pdf. Come back if it still doesn't work out and I'll give examples relevant to your last post.

Edit; add link to continuing post
http://eectuning.org/forums/viewtopic.p ... 99#p136061

[jamie from oz]

John

That structure was in the origional Dir you had helped me with . You must have found it and added it but i hadnt made the conection to it.

ViECT ?? not sure about that.
i may have had it in a previoud Dir and changed it when i realised iECT was the same.

[jsa]

Jamie,

Indeed.

ECTMin/Max earlier on sorry, but ViECT is added also.
https://eectuning.org/forums/viewtopic. ... 57#p136055

You cross posted while I was fixing my last post.

No, only just added them now that I convinced myself it is correct.