[jamie from oz]

John
I'm not sure if this is relevant.
Fault code 116 is coolant temp out of range.
Fault code 117 is coolant sensor voltage low.
Fault code 118 coolant sensor voltage high.

Think this is what you refered to .
i hadnt made the conection untill i realised that some adderesses i was logging are fault codes that where in the iECT_iMAP_Test code.

[jsa]

Jamie,

cross post mayhem lol.

go back a couple posts.
https://eectuning.org/forums/viewtopic. ... 57#p136055

[jsa]

Jamie,

Continuing on from the previous post;
https://eectuning.org/forums/viewtopic. ... 57#p136055

As luck would have it, the args I selected did not decode to anywhere near xE22A that you asked for help with.
We now understand the decode Subr, so we can create the encoded args for xE22A to make it easier to find what we are looking for.


Looking at the Rbase pointers, let's calculate the encoded Rbase offset from xE0.

Code: Select all

                          Rbase  Offset
                         Offset   Shift
                   Rbase  to E0  Left 3
2062:  00,c0  c000    F0     10	   80   
2064:  74,c3  c374    F2     12	   90   
2066:  82,c4  c482    F4     14	   A0   
2068:  4a,c8  c84a    F6     16	   B0   
206a:  84,cc  cc84    F8     18	   C0   
206c:  2e,cd  cd2e    FA     1A	   D0   
206e:  14,db  db14    FC     1C	   E0
2070:  7a,e7  e77a    FE     1E	   F0

Let's calculate the address offset from Rbase FC

Code: Select all

The offset from Rbase FC to xE22A is;
xDB14-xE22A=x0716.

Let's generate the encoded Arg

Code: Select all

Combine the 2 offsets;
 E0
 0716
xE716

LST would look something like

Code: Select all

 addr: 16,E7  #Arg 1  E716

Let's run the decode

Code: Select all

R2A,R2B
R4A,R4B
 16,E7  #Arg 1  E716

   Sub_a37f:
a386: a2,46,4a            ldw   R4a,[R46]        R4Ascr = [R46];                   # xE716 b1110 0111 0001 0110
a389: 37,4b,11            jnb   B7,R4b,a39d      if (B7_R4b = 1)  {                # xE7   b1110 0111
a38c: ac,4b,42            ldzbw R42,R4b          wR42 = yR4b;                      #       b0000 0000 1110 0111
a38f: 71,0f,4b            an2b  R4b,f            R4b &= f;                         # Clear 0 B7 B6 B5 B4 of High byte
                                                                                   # x07   b0000 0111
a392: 08,03,42            shrw  R42,3            R42 >>= 3;                        # x1C   b0000 0000 0001 1100
a395: 67,43,e0,00,4a      ad2w  R4a,[R42+e0]     R4Ascr += [R42+e0];               # += [x1C+xE0] is Rbase FC.. E22A = 716+DB14
a39a: c2,46,4a            stw   R4a,[R46]        [R46] = R4Ascr; }                 # Store scalar xE22A to R2A
a39d: f0                  ret                    return;

Searching the bin for an E716 like Arg does not find anything.
A few around F47A are found, let's decode

Code: Select all

     R2A,R2B
     R4A,R4B
a33a: 7a,f4                     #arg 1              f47a,

   Sub_a37f:
a386: a2,46,4a            ldw   R4a,[R46]        R4Ascr = [R46];                   # xF47A b1111 0100 0111 1010
a389: 37,4b,11            jnb   B7,R4b,a39d      if (B7_R4b = 1)  {                # xF4   b1111 0100
a38c: ac,4b,42            ldzbw R42,R4b          wR42 = yR4b;                      # x00F4 b0000 0000 1111 0100
a38f: 71,0f,4b            an2b  R4b,f            R4b &= f;                         # Clear 0 B7 B6 B5 B4 of High byte
                                                                                   # x04   b0000 0100
a392: 08,03,42            shrw  R42,3            R42 >>= 3;                        # x1E   b0000 0000 0001 1110
a395: 67,43,e0,00,4a      ad2w  R4a,[R42+e0]     R4Ascr += [R42+e0];               # += [x1E+xE0] is Rbase FE.. EBF4 = 47A+E77A
a39a: c2,46,4a            stw   R4a,[R46]        [R46] = R4Ascr; }                 # Store scalar xEBF4 to R2A
a39d: f0                  ret                    return;

From the Bin

Code: Select all

ebf4: 80,02,00,e1,80,02,80,89,c8,c8  ???  

Add to DIR

Code: Select all

WOR  EBF4 EBF5
etc.

Add to CMT

Code: Select all

A33A # [EBF4] \sEBF4
etc

The search for the purpose of E22A etc continues.

[jsa]

How can i make the Args display as words not bytes ?

a450 a451 look like should be 0791

Code: Select all

##### Fault Tests KOER Tests not displayed correctly ######
a448: 28,bf               scall a509             Sub_a509 (
a44a: 58,90                     #arg 1              9058,
a44c: 42,04                     #arg 2              442,
a44e: 00                        #arg 3              0,
a44f: 05                        #arg 4              5,
a450: 91                        #arg 5              91,
a451: 07                        #arg 6              7 );

DIR

Code: Select all

Sub  A509 "Sub509_" :UW :UW :UWN :UW

LST

Code: Select all

a448: 28,bf               scall a509             Sub509_ (
a44a: 58,90                     #arg 1              9058,
a44c: 42,04                     #arg 2              442,
a44e: 00,05                     #arg 3              500_out,
a450: 91,07                     #arg 4              791 );

[jamie from oz]

Thanks John,

The help is much appreciated and will look over it better tonight .

[jamie from oz]

I have had a bit of a look and think i understand some of that .

I had previously looked for the R base addresses and manually added and counted through to find things as i dont have a reference in my List

Code: Select all

2060: 08                  byte      8
2061: 01                  byte      1
2062: 00,c0               word   c000
2064: 74,c3               word   c374
2066: 82,c4               word   c482
2068: 4a,c8               word   c84a
206a: 84,cc               word   cc84
206c: 2e,cd               word   cd2e
206e: 14,db               word   db14
2070: 7a,e7               word   e77a

[code##### e77a is Rfe+0 / e77c is Rfe+2 ########
e77a: ca,ed word edca
e77c: 0a byte a
e77d: 02 byte 2
e77e: 40 byte 40][/code]

bit of a hard way to do it but tho.


not sure if i have A33A correct ? F47A-886=EBF4 ? as others are added ????

Code: Select all

A29D # [C3F0] \sC3F0  #907c+3374=c3f0
A29F # [C3F2] \sC3F2
A2B3 # [C3BA]         #9046+3374=c3ba
A2CA # [C3DE]         #906a
A2EB # [C37C]         #9008+3374=c37c



A33A # [EBF4] \sEBF4    #f47a-886?=EBF4 added to sort encoded addresses

[jsa]

I had previously looked for the R base addresses and manually added and counted through to find things as i dont have a reference in my List

Code: Select all

2060: 08                  byte      8
2061: 01                  byte      1
2062: 00,c0               word   c000
2064: 74,c3               word   c374
2066: 82,c4               word   c482
2068: 4a,c8               word   c84a
206a: 84,cc               word   cc84
206c: 2e,cd               word   cd2e
206e: 14,db               word   db14
2070: 7a,e7               word   e77a

The Rbases will be listed in MSG. You can add the details to CMT and have them print in LST.

Code: Select all

##### e77a is Rfe+0 /   e77c is Rfe+2 ########
e77a: ca,ed               word   edca
e77c: 0a                  byte      a
e77d: 02                  byte      2
e77e: 40                  byte     40]

bit of a hard way to do it but tho.

Code: Select all

c000: 74,c3               word   c374
c374: 82,c4               word   c482
c482: 4a,c8               word   c84a
c84a: 84,cc               word   cc84
cc84: 2e,cd               word   cd2e
cd2e: 14,db               word   db14
db14: 7a,e7               word   e77a
e77a: ca,ed               word   edca
edca -> ffff = 0xff  ## fill ## 

Better off putting comments against x2062 - x2070 for clarity.

not sure if i have A33A correct ? F47A-886=EBF4 ? as others are added ????

Code: Select all

A33A # [EBF4] \sEBF4    #f47a-886?=EBF4 added to sort encoded addresses

Code: Select all

     R2A,R2B
     R4A,R4B
a33a: 7a,f4                     #arg 1              f47a,

   Sub_a37f:
a386: a2,46,4a            ldw   R4a,[R46]        R4Ascr = [R46];                   # xF47A b1111 0100 0111 1010
a389: 37,4b,11            jnb   B7,R4b,a39d      if (B7_R4b = 1)  {                # xF4   b1111 0100
a38c: ac,4b,42            ldzbw R42,R4b          wR42 = yR4b;                      # x00F4 b0000 0000 1111 0100
a38f: 71,0f,4b            an2b  R4b,f            R4b &= f;                         # Clear 0 B7 B6 B5 B4 of High byte
                                                                                   # x04   b0000 0100
a392: 08,03,42            shrw  R42,3            R42 >>= 3;                        # x1E   b0000 0000 0001 1110
a395: 67,43,e0,00,4a      ad2w  R4a,[R42+e0]     R4Ascr += [R42+e0];               # += [x1E+xE0] is Rbase FE.. EBF4 = 47A+E77A
a39a: c2,46,4a            stw   R4a,[R46]        [R46] = R4Ascr; }                 # Store scalar xEBF4 to R2A
a39d: f0                  ret                    return;

EBF4 is what I got above.


Oops, I'm off on a tangent with E22A, it was E33A and E362 you initially asked about.
E22A is an immediate value so it can be sussed without decoding.

[jamie from oz]

Thanks John,

yes i added to Cmt. (starting to make sense using Dir and Cmt as i had been making notes in a renamed Lst for reference)

No problem as i have fat fingered a few addresses and when i looked back wondered how i come up with it.

[jamie from oz]

Oops, I'm off on a tangent with E22A, it was E33A and E362 you initially asked about.
E22A is an immediate value so it can be sussed without decoding.

just wondering about the structure at 0x23FA as when i serch for that address it references a word?

Code: Select all

 ###STR  23FA 2421 $Q1 :UY :UW
23fa: 40,2a,06            struct   40,   62a
23fd: 41,44,04            struct   41,   444
2400: 42,3e,04            struct   42,   43e
2403: 44,7c,04            struct   44,   47c
2406: 45,50,06            struct   45,   650
2409: 48,46,04            struct   48,   446
240c: 49,48,04            struct   49,   448
240f: 4a,4c,04            struct   4a,   44c
2412: 4b,4a,04            struct   4b,   44a
2415: 4b,52,04            struct   4b,   452
2418: 4d,2e,07            struct   4d,   72e
241b: 4f,56,04            struct   4f,   456
241e: 4c,58,04            struct   4c,   458
2421: ff                        ## terminator

Code: Select all

3878: f0                  ret                    return;

   Sub_3879:
3879: a1,fa,23,38         ldw   R38,23fa         R38 = 23fa;
   Sub_387d:
387d: fb                  ei                     interrupts ON;

is it possible that this is a Sub_ or some thing else ??

jamie

[jsa]

just wondering about the structure at 0x23FA as when i serch for that address it references a word?

Code: Select all

 ###STR  23FA 2421 $Q1 :UY :UW
23fa: 40,2a,06            struct   40,   62a
[code]3878: f0                  ret                    return;

   Sub_3879:
3879: a1,fa,23,38         ldw   R38,23fa         R38 = 23fa;
   Sub_387d:
387d: fb                  ei                     interrupts ON;

is it possible that this is a Sub_ or some thing else ??

jamie

23FA is not a sub.

Looking at only two lines of code at 3879 & 387D will not allow yo to determine what the purpose of 23FA is.

It is necessary to look at the whole subroutine.
Do you recognise this subroutine?
Can you explain how 23FA is being used in this subroutine?

Code: Select all

   Sub_3879:
3879: a1,fa,23,38         ldw   R38,23fa         R38 = 23fa;
   Sub_387d:
387d: fb                  ei                     interrupts ON;
387e: b2,38,3a            ldb   R3a,[R38]        R3a = [R38];
3881: 3f,3a,28            jb    B7,R3a,38ac      if (B7_R3a = 0)  {
3884: 71,0f,3a            an2b  R3a,f            R3a &= f;
3887: c4,04,3a            stb   R3a,R4           AD_Cmd = R3a;
388a: fb                  ei                     interrupts ON;
388b: 33,0a,fd            jnb   B3,Ra,388b       if (ATOD = 0) goto 388b;
388e: fa                  di                     interrupts OFF;
388f: 51,0f,04,3c         an3b  R3c,R4,f         R3c = ATOD_LOW & f;
3893: 98,3a,3c            cmpb  R3c,R3a          
3896: d7,e5               jne   387d             if (R3c != R3a) goto Sub_387d;
3898: 51,f0,04,3c         an3b  R3c,R4,f0        R3c = ATOD_LOW & f0;
389c: b0,05,3d            ldb   R3d,R5           R3d = ATOD_HI;
389f: 07,38               incw  R38              R38++;
38a1: b2,39,3a            ldb   R3a,[R38++]      R3a = [R38++];
38a4: b2,39,3b            ldb   R3b,[R38++]      R3b = [R38++];
38a7: c2,3a,3c            stw   R3c,[R3a]        [R3a] = R3c;
38aa: 27,d1               sjmp  387d             goto Sub_387d; }

38ac: f0                  ret                    return;

[jamie from oz]

6dbd_56k_x.bin

I just worked out that they are ADC payloads.

Code: Select all

 #### BACKGROUND VECTOR LIST
237c: fa,ab               vect  abfa             SbgABFA_CC_Patch                  # Console Sub will be over written with patchcode
237e: de,7f               vect  7fde             Sub_7fde
2380: 79,38               vect  3879             Sub_3879
2382: ec,7a               vect  7aec             Sub_7aec
2384: ac,82               vect  82ac             Sub_82ac
2386: c9,80               vect  80c9             Sub_80c9
2388: 6c,9e               vect  9e6c             Sub_9e6c
238a: 27,93               vect  9327             Sub_9327
238c: 87,95               vect  9587             Sub_9587
238e: 57,37               vect  3757             Sub_3757
2390: 6c,81               vect  816c             Sub_816c
2392: e7,81               vect  81e7             Sub_81e7
2394: 25,88               vect  8825             Sub_8825
2396: 2f,83               vect  832f             Sub_832f
2398: d3,83               vect  83d3             Sub_83d3
239a: 73,99               vect  9973             Sub_9973
239c: 16,ac               vect  ac16             Sub_ac16
239e: 57,89               vect  8957             Sub_8957
23a0: 27,9a               vect  9a27             Sub_9a27
23a2: 11,97               vect  9711             Sub_9711
23a4: 9b,92               vect  929b             Sub_929b
23a6: 7f,89               vect  897f             Sub_897f
23a8: dd,ae               vect  aedd             Sub_aedd
23aa: 48,ae               vect  ae48             Sub_ae48
23ac: 77,9a               vect  9a77             Sub_9a77
23ae: 52,9b               vect  9b52             Sub_9b52
23b0: 5b,22               vect  225b             Sub_225b
23b2: fa,ab               vect  abfa             SbgABFA_CC_Patch
23b4: c9,80               vect  80c9             Sub_80c9
23b6: 79,38               vect  3879             Sub_3879
23b8: ec,7a               vect  7aec             Sub_7aec
23ba: 57,37               vect  3757             Sub_3757
23bc: 6c,81               vect  816c             Sub_816c
23be: 25,88               vect  8825             Sub_8825
23c0: 27,93               vect  9327             Sub_9327
23c2: 87,95               vect  9587             Sub_9587
23c4: ac,82               vect  82ac             Sub_82ac
23c6: 57,89               vect  8957             Sub_8957
23c8: 77,9a               vect  9a77             Sub_9a77
23ca: 52,9b               vect  9b52             Sub_9b52
23cc: a7,ab               vect  aba7             Sub_aba7
23ce: 5b,22               vect  225b             Sub_225b
23d0: fa,ab               vect  abfa             SbgABFA_CC_Patch
23d2: 79,38               vect  3879             Sub_3879
23d4: ec,7a               vect  7aec             Sub_7aec
23d6: 57,37               vect  3757             Sub_3757
23d8: 6c,81               vect  816c             Sub_816c
23da: 25,88               vect  8825             Sub_8825
23dc: 27,93               vect  9327             Sub_9327
23de: 87,95               vect  9587             Sub_9587
23e0: ac,82               vect  82ac             Sub_82ac
23e2: 74,4e               vect  4e74             Sub_4e74
23e4: 57,89               vect  8957             Sub_8957
23e6: 7f,89               vect  897f             Sub_897f
23e8: d3,83               vect  83d3             Sub_83d3
23ea: 91,a9               vect  a991             Sub_a991
23ec: 85,a9               vect  a985             Sub_a985
23ee: 77,9a               vect  9a77             Sub_9a77
23f0: 52,9b               vect  9b52             Sub_9b52
23f2: 5b,22               vect  225b             Sub_225b
23f4: fa,ab               vect  abfa             SbgABFA_CC_Patch
23f6: a0,9a               vect  9aa0             Sub_9aa0
23f8: 5b,22               vect  225b             Sub_225b

 ###STR  23FA 2421 $Q1 :UY :UW
23fa: 40,2a,06            struct   40,   62a
23fd: 41,44,04            struct   41,   444
2400: 42,3e,04            struct   42,   43e
2403: 44,7c,04            struct   44,   47c
2406: 45,50,06            struct   45,   650
2409: 48,46,04            struct   48,   446
240c: 49,48,04            struct   49,   448
240f: 4a,4c,04            struct   4a,   44c
2412: 4b,4a,04            struct   4b,   44a
2415: 4b,52,04            struct   4b,   452
2418: 4d,2e,07            struct   4d,   72e
241b: 4f,56,04            struct   4f,   456
241e: 4c,58,04            struct   4c,   458
2421: ff                        ## terminator

2422: 80,24,7d,26,00,29,40,1c,73,33,8f,26,00,09,c0,1c  ???  
2432: 38,33,7d,26,00,28,40,02,4b,2f,8f,26,00  ???  

243f: 08                  byte      8
2440: c0                  byte     c0
2441: 02                  byte      2

[jamie from oz]

long days at work and hrs of looking at code i didn't see the link but at least i made the conection...
Was hoping it was relevent to the code at 0xE22A and 0xE33A that i think are trans shift tables and possibly knock tables.

Code: Select all

23f8: 5b,22               vect  225b             Sub_225b

 ## ADC list ##STR  23FA 2421 $Q1 :UY :UW
23fa: 40,2a,06            struct   40,   62a
23fd: 41,44,04            struct   41,   444
2400: 42,3e,04            struct   42,   43e
2403: 44,7c,04            struct   44,   47c
2406: 45,50,06            struct   45,   650
2409: 48,46,04            struct   48,   446
240c: 49,48,04            struct   49,   448
240f: 4a,4c,04            struct   4a,   44c
2412: 4b,4a,04            struct   4b,   44a
2415: 4b,52,04            struct   4b,   452
2418: 4d,2e,07            struct   4d,   72e
241b: 4f,56,04            struct   4f,   456
241e: 4c,58,04            struct   4c,   458
2421: ff                        ## terminator

[jsa]

Yep ADC.
Sub387d gives a hint. It does ADC with the indexed address of the structure set elsewhere. Search for 387d in LST to nail down another short structure.

Which input is the knock sensor connected too?

[jsa]

Was hoping it was relevant to the code at 0xE22A and 0xE33A that i think are trans shift tables and possibly knock tables.

I think you are on the right track with 0xE022A upwards being Auto trans related. I can see you have tracked through code from iTOT and named some payloads, scalars and functions.

None of it looks familiar to me, but I've not looked at auto TX code as I have manuals.

I see you have named stuff with question marks indicating some level of uncertainty.

Looking at iTOT check and conversion.

Code: Select all

   Sub_607c:
607c: 71,fd,89            an2b  R89,fd           iTOT_OOR1 = 0;
607f: a3,fc,4c,5e         ldw   R5e,[Rfc+4c]     R5e = iTOTMax_5.0v;
6083: 8b,68,d8,5e         cmpw  R5e,[R68+d8]     
6087: d3,0a               jnc   6093             if (R5e >= iTOT)  {
6089: a3,fc,4e,5e         ldw   R5e,[Rfc+4e]     R5e = iTOTMin_0.1v;
608d: 8b,68,d8,5e         cmpw  R5e,[R68+d8]     
6091: d1,22               jleu  60b5             if (R5e <= iTOT) goto 60b5; }
6093: 91,02,89            orb   R89,2            iTOT_OOR1 = 1;
6096: 91,04,89            orb   R89,4            iTOT_OOR2 = 1;
6099: a3,fd,88,00,38      ldw   R38,[Rfc+88]     R38 = [db9c];
609e: c3,68,da,38         stw   R38,[R68+da]     652_in = R38;
60a2: a3,fd,88,00,38      ldw   R38,[Rfc+88]     R38 = [db9c];
60a7: c3,68,ea,38         stw   R38,[R68+ea]     662_in = R38;
60ab: a3,fc,46,38         ldw   R38,[Rfc+46]     R38 = [db5a];
60af: c3,68,b0,38         stw   R38,[R68+b0]     628_out = R38;
60b3: 20,7e               sjmp  6133             goto 6133; }

Analog inputs are 5.12v or 5.0v and subject of debate around processor version, IO expansion, convention or whatever. The inputs are ratiometric, so the argument is somewhat moot.
You could measure your sensor ~5v supply with a precision instrument to find out what your particular EEC is operating at, then come up with what ever scaling factor fits.

2^16/5.12=12800
2^16/5.00=13107

I'm going with 12800 because its embedded in my nong.
Using the V 12800 command option is divide the decimal equivalent of the hex value by 12800.

So iTOT counts can be converted to volts along with everything compared directly to iTOT.
This applies equally to other AI's.

To make progress, it is necessary to find strategy information that is similar to the bin code.
So I search the strategy documents for iTOT. In CBAZA I find something similar to above on page 27-30.

I now have names and values for these two.

Code: Select all

SYM  db60  "iTOTMax_5.0v"         :V 12800  # CBAZA 27-30
SYM  db62  "iTOTMin_0.1v"         :V 12800

These are set when iTOT is out of range. One of them may be ECTCNT, but I have not looked at this point.

Code: Select all

SYM  0089 "Flg89"
SYM  0089 "iTOT_OOR1"                  :B1     # could be ECTCNT CBAZA 27-30
SYM  0089 "iTOT_OOR2"                  :B2

This could be renamed as "FN703D_iTOT_Tfr", as the code above jumps to this lookup if iTOT is in range.

Code: Select all

fun  dc0e dc39 "iTOT_Transfer": UW V 12800 : SW X 10 

DB9C and DB5A are possibly some sought of substitute values, but CBAZA does not appear to help with those. It's a case of looking through the other strategies to look for a better match.

To make further progress all the payloads, scalars, functions and tables need names and unit conversions, so that stuff makes obvious sense when looking at the LST.

How many numbers can you read, retain and recall??...us humans have a pretty limited ability to keep track of bunches of numbers. We are much better at names. To that end you need to start comparing bin code to strategies to uncover names and purposes of the code. If one of the public strategies uses the same auto box, then that would be the one to pay most attention too, unless the aussie auto is some brumby.

[jamie from oz]

Yes i put question marks untill i confirm that is correct or doing what i expect.
I have iTOT max /min in my BE XLS but only put a equasion to have it close to what my cold ECT / ACT are in my data log.
Will look into that more.

Looking in AU V8 Falcon NGVC0 xls it has other shift tables but it is more complex with adaptive shift (eg FN1501A / FN1502A / FN1503A)

NGVC0.xls

I will put my notes into the CMT file now that i have worked out how that works. I normally have 2 notepads going one with notes and one that has the Dir / Cmt added so i can search one to follow the code.

[jsa]

Has the ngvc0 def been converted to a DIR?

Matching code between strategies is as good a way as any.

Yeah, some times I have multiple copies of LST open in text editor windows as various file addresses.

[jamie from oz]

Has the ngvc0 def been converted to a DIR?

I have used it as a base for my NGVB5 / Y3EE in my AU 1.5 xr8 and have been working on it also adding bit by bit (about 0x14200 there is a extra word in NGVC0 .

Is there a easy way to convert it to a DIR ??

[jsa]

Is there a easy way to convert it to a DIR ??

Do bears shit in the woods...

NGVC0_20230324.xls

22NA_stock_read_DIR.txt

There are bugs in the Def, I didn't fix all.
When using the Def generated commands in DIR, some errors will show up in MSG.
The attached DIR has been debugged to an extent but some may still lurk due to Def errors and excel formula errors.

You may realise that a Def can be created in reverse fashion from a DIR if the DIR is built carefully.

[jamie from oz]

Is there a easy way to convert it to a DIR ??

Do bears shit in the woods...

Hmmm ?? Polar bears probably dont ...

I will have a look and compare to what i have.
Thank you

[jamie from oz]

John that is a impressive conversion to Dir.
That would have taken me a couple of months to copy over.
I will see how that goes and will help solve some of the 6dbd decoading.

Thanks very much.

[034v]

FWIW I always strip all padding on 2 and 4 bank, add where needed (depending on tuning editor used), reverse where needed (again depending on tuning editor used) with either https://hexed.it/ or reverse bank ordering software from https://www.customecm.com/custom-software... Saves me a ton of headaches.

Only issue I have is tuning a 56k single bank on a TI Performance chip with TPRT.

[jsa]

Polar bears, yep always an exception.

Yeah, pass on the endless hours of typing def info into a DIR.

[jamie from oz]

Jamie,

Code: Select all

                          Rbase  Offset
                         Offset   Shift
                   Rbase  to E0  Left 3
2062:  00,c0  c000    F0     10	   80   
2064:  74,c3  c374    F2     12	   90   
2066:  82,c4  c482    F4     14	   A0   
2068:  4a,c8  c84a    F6     16	   B0   
206a:  84,cc  cc84    F8     18	   C0   
206c:  2e,cd  cd2e    FA     1A	   D0   
206e:  14,db  db14    FC     1C	   E0
2070:  7a,e7  e77a    FE     1E	   F0

John,

I thought i had the encoded addresses worked out but cant work out the ones like 0xA310: C050.

Code: Select all

   Sub_a30b_iTPS_Test:
a30b: b0,38,3a            ldb   R3a,R38          R3a = R38;
a30e: 28,50               scall a360             SubA360_6Args_To_R2A... (
a310: 50,c0                     #arg 1              c050,                          # [] C050
a312: 54,04                     #arg 2              454,
a314: 22,01                     #arg 3              122 );
a316: 28,48               scall a360             SubA360_6Args_To_R2A... (
a318: 54,04                     #arg 1              454,
a31a: 4e,c0                     #arg 2              c04e,                          # [] C04E
a31c: 23,01                     #arg 3              123 );
a31e: 98,38,3a            cmpb  R3a,R38          
a321: d7,0a               jne   a32d             if (R3a = R38)  {
a323: 2b,5e               scall a683             Sub_a683 (
a325: 54,04                     #arg 1              454,
a327: 3a,90                     #arg 2              903a,                          # [C3AE] 903A
a329: 3c,90                     #arg 3              903c,                          # [C3B0] 903C
a32b: 21,01                     #arg 4              121 ); }
a32d: f0                  ret                    return;

?? Rbase F0 is C000. C050 - C000 = 50 and combine 80 and 50 = 5080 so that gives me C050 - 5080 = 6FD0 and that isnt correct i know . Where did i go so wrong ?

Code: Select all

2062: 00,c0               word   c000                                              # Rbase F0       10  80 
2064: 74,c3               word   c374                                              # Rbase F2       12  90
2066: 82,c4               word   c482                                              # Rbase F4       14  A0
2068: 4a,c8               word   c84a                                              # Rbase F6       16  B0
206a: 84,cc               word   cc84                                              # Rbase F8       18  C0
206c: 2e,cd               word   cd2e                                              # Rbase FA       1A  D0
206e: 14,db               word   db14                                              # Rbase FC       1C  E0
2070: 7a,e7               word   e77a                                              # Rbase FE       1E  F0

 ##The offset from Rbase FC to xE22A is; xDB14-xE22A=x0716 #Combine the 2 offsets; E0 0716 = xE716    ####

[jsa]

John,

I thought i had the encoded addresses worked out but cant work out the ones like 0xA310: C050.
.
.
Where did i go so wrong ?

Jamie,
Go back to this spreadsheet and use 50,C0 to work through it line by line.
I'm thinking that Indexed Addressing is not well understood, search for that in the software manual.
https://eectuning.org/forums/download/file.php?id=5270

Put this in DIR for 4.12a.

Code: Select all

Sub  A360 "SubA360_6Args_To_R2A..."   :E1 E0 N :E1 E0 N :E1 E0

Have a look in the SAD help file to find some detail on the options.

Code: Select all

   Sub_a30b:
a30b: b0,38,3a            ldb   R3a,R38          R3a = R38;
a30e: 28,50               scall a360             SubA360_6Args_To_R2A... (
a310: 50,c0                     #arg 1              ?itps_min_a/c,                       # [CCD4]
a312: 54,04                     #arg 2              454,
a314: 22,01                     #arg 3              122 );
a316: 28,48               scall a360             SubA360_6Args_To_R2A... (
a318: 54,04                     #arg 1              454,
a31a: 4e,c0                     #arg 2              ?itps_max_a/c,                       # [CCD2]
a31c: 23,01                     #arg 3              123 );

CO >> 3 = 18
18 + E0 = F8
[F8] = CC84
CC84 + 50 = CCD4

You could name them;
S.TAPMIN_0.25V
S.TAPMAX_4.95V

If you search the strategy documents for TAPMIN or TAPMAX, LHBH1 will have them and the names associated with the CODE 121 scalars. You could use x/12800 to come up with the voltages associated with those.

[jamie from oz]

Ok i get that .
my reference to A/C is probably incorrect and i will correct that .
This is some of the Fault codes i have listed in my Cmt and Dir that i added from the workshop manual.

Thanks John.

Code: Select all

#### "Fault_Codes"
STR  9b16 9b17:UW          #112#iat sensor voltage low
STR  9b18 9b19:UW          #113#iat sensor voltage high      
STR  9b1a 9b1b:UW          #117#cts sensor voltage low
STR  9b1c 9b1d:UW          #118#cts sensor voltage high
STR  9b1e 9b1f:UW          #122#tps volt low
STR  9b20 9b21:UW          #123#tps volt high
STR  9b22 9b23:UW          #126#map out of range
STR  9b24 9b25:UW          #211#distributor pip eratic

[jsa]

You will find more fault code names listed in the strategy docs.

Google is good for finding names too.

Other disassemblies on github will also help.

[jamie from oz]

John,

6DBD.
Can you help with encoded addresses in Sub_A0BE please.

Any with 8### don't decode and i have tried xF0 and xE0 but i was getting lost/confused in how to decode them.
From our previous decoding encoded addresses my understanding is 8015 would be decoded as 80 refers to F0 that = C000 and add 15 that would be address combined to be C000+15=C015 ??

DIR.

Code: Select all

Sub  A0BE "Sub_A0BE_" :E1 E0                                #2/4/23 jm to get arg display correct.
Sub  A195 "SubA195_xArgs_To_R2A..."                       # Transfer Arg count R2A etc.
Sub  A199 "SubA199_xArgs_To_Rxx..."                       # Transfer Arg count Rxx etc.

Sub  A1AE "Sub_a1ae_"  :E1 E0 N : E1 E0 N                 #UW :UW
Sub  A237 "SubA237_Checksum"

LST.

Code: Select all

9fab: ef,10,01            call  a0be             Sub_a0be_ (
9fae: 15,80                     #arg 1              8015 );
9fb0: 91,40,80            orb   R80,40           B6_R80 = 1;
9fb3: 3e,8f,03            jb    B6,R8f,9fb9      if (B6_R8f = 0)  {
9fb6: 71,bf,80            an2b  R80,bf           B6_R80 = 0; }
9fb9: ef,02,01            call  a0be             Sub_a0be_ (
9fbc: 16,80                     #arg 1              8016 );
9fbe: 91,40,80            orb   R80,40           B6_R80 = 1;
9fc1: 3d,8f,03            jb    B5,R8f,9fc7      if (B5_R8f = 0)  {
9fc4: 71,bf,80            an2b  R80,bf           B6_R80 = 0; }
9fc7: ef,f4,00            call  a0be             Sub_a0be_ (
9fca: 17,80                     #arg 1              8017 );
9fcc: 91,40,80            orb   R80,40           B6_R80 = 1;
9fcf: 3c,8f,03            jb    B4,R8f,9fd5      if (B4_R8f = 0)  {
9fd2: 71,bf,80            an2b  R80,bf           B6_R80 = 0; }
9fd5: ef,e6,00            call  a0be             Sub_a0be_ (
9fd8: 18,80                     #arg 1              8018 );
9fda: 91,40,80            orb   R80,40           B6_R80 = 1;

Rbase.

Code: Select all

2062: 00,c0               word   c000                                              # Rbase F0       10  80 
2064: 74,c3               word   c374                                              # Rbase F2       12  90
2066: 82,c4               word   c482                                              # Rbase F4       14  A0
2068: 4a,c8               word   c84a                                              # Rbase F6       16  B0
206a: 84,cc               word   cc84                                              # Rbase F8       18  C0
206c: 2e,cd               word   cd2e                                              # Rbase FA       1A  D0
206e: 14,db               word   db14                                              # Rbase FC       1C  E0
2070: 7a,e7               word   e77a                                              # Rbase FE       1E  F0

C014 is a byte and C015 should also be a byte.

Code: Select all

c00c: d0,07               word    7d0            c00c_smtlock_vs_N
c00e: 9b,00               word     9b
c010: 64,07               word    764
c012: 5a,00               word     5a            smartlock_pulses_min?
c014: 01,ff               word   ff01            smart_lock_enable
c016: 05,00               word      5
c018: 01,ff               word   ff01            Power/Eco_sw_present              # 1=p/e switch?
c01a: ff,ff               word   ffff

[jsa]

John,

6DBD.
Can you help with encoded addresses in Sub_A0BE please.

[/code]

Jamie,

Yes I can, may not be till the coming weekend, work...work...work.

[jamie from oz]

John,

6DBD.
Can you help with encoded addresses in Sub_A0BE please.

[/code]

Jamie,

Yes I can, may not be till the coming weekend, work...work...work.

Think i found it :E2 F0 seems to be actual addresses

[jamie from oz]

John,

my next encoded address problem.

Code: Select all

a00a: 29,a2               scall a1ae             Sub_a1ae_ (
a00c: 03,00                     #arg 1              LIO_Port,
a00e: 80,98                     #arg 2              cbf4 );
a010: 29,9c               scall a1ae             Sub_a1ae_ (
a012: 0c,00                     #arg 1              HSI_Mask,
a014: 40,98                     #arg 2              cbb4 );
a016: 29,96               scall a1ae             Sub_a1ae_ (
a018: c0,01                     #arg 1              1c0,
a01a: 02,98                     #arg 2              cb76 );
a01c: 29,90               scall a1ae             Sub_a1ae_ (
a01e: c0,00                     #arg 1              c0,
a020: 10,98                     #arg 2              cb84 );
a022: 29,8a               scall a1ae             Sub_a1ae_ (
a024: 01,01                     #arg 1              101,
a026: 21,99                     #arg 2              cc95 );
a028: 29,84               scall a1ae             Sub_a1ae_ (
a02a: 02,01                     #arg 1              102,
a02c: 12,99                     #arg 2              cc86 );
a02e: 29,7e               scall a1ae             Sub_a1ae_ (
a030: 04,01                     #arg 1              104,
a032: 0c,99                     #arg 2              cc80 );
a034: 29,78               scall a1ae             Sub_a1ae_ (
a036: 20,00                     #arg 1              StackPtr,
a038: 08,98                     #arg 2              cb7c );
a03a: 29,72               scall a1ae             Sub_a1ae_ (
a03c: 10,00                     #arg 1              HSO_IntPend1,
a03e: 04,98                     #arg 2              cb78 );
a040: 29,6c               scall a1ae             Sub_a1ae_ (
a042: 20,01                     #arg 1              120,
a044: 40,99                     #arg 2              ccb4 );

Sub_a1ae . have tried :UW N :E2 E0/F0 and :UW :E1 E0/F0 but address 0xcbf4 appears to be in a function.
edit. have tried :UW N : E4 F0 N and appears to be valid addresses but not sure if this is correct ?

Code: Select all

SUB A0BE "Sub_a0be_" :E2 F0 N     # good
SUB A1AE "Sub_a1ae_" :UW N : E1 E0 N

Code: Select all

   Func_cbda:
cbda: ff,7f,00,00         func   32767,         0    
cbde: 00,80,00,00         func  -32768,         0    
cbe2: 00,80,00,00         func  -32768,         0    
cbe6: 00,80,00,00         func  -32768,         0    
cbea: 00,80,00,00         func  -32768,         0    
cbee: 00,80,00,00         func  -32768,         0    
cbf2: 00,80,00,00         func  -32768,         0 

Thanks,
Jamie