[andyt12]

Im hoping someone can shed some light on how to find the transfer function for the MAP sensor in the code Im working with.

Im working with an Australian Ford SD ECU which was released around 1998.

In previous model years it was easy to find the MAP/BP transfer as all fords seemed to use the same MAP sensor, but in 98 they changed to a integrated TMAP sensor which puts out volts instead of frequency. They also changed the ACT and ECT sensors but I found them by looking through the disassembly for the lookup routine which was the same as previous model years. I cant find similar routines for the MAP lookup.

Ive tried hooking up a pot and simulating the MAP input and reading back the RAM looking for changes and found 2 locations which change, one BYTE 0 - 255 and one WORD 0 - 1023. I then used the RAM pointers to work out the indexed address the EEC would use to read/store at these locations but come up with nothing.

So what route would you experienced bin hackers take into finding this transfer function ?

Ive attached my disassembly if anyone wishes to take a look.
Ram locations for MAP word are 0x1060 and MAP byte are 0x063F

Regards.

[mpaton]

Im hoping someone can shed some light on how to find the transfer function for the MAP sensor in the code Im working with.

Im working with an Australian Ford SD ECU which was released around 1998.

In previous model years it was easy to find the MAP/BP transfer as all fords seemed to use the same MAP sensor, but in 98 they changed to a integrated TMAP sensor which puts out volts instead of frequency. They also changed the ACT and ECT sensors but I found them by looking through the disassembly for the lookup routine which was the same as previous model years. I cant find similar routines for the MAP lookup.

Ive tried hooking up a pot and simulating the MAP input and reading back the RAM looking for changes and found 2 locations which change, one BYTE 0 - 255 and one WORD 0 - 1023. I then used the RAM pointers to work out the indexed address the EEC would use to read/store at these locations but come up with nothing.

So what route would you experienced bin hackers take into finding this transfer function ?

Ive attached my disassembly if anyone wishes to take a look.
Ram locations for MAP word are 0x1060 and MAP byte are 0x063F

Regards.

I would first find the function and table lookup routines, and that would probably identify 90% of the tables. I'd also see if I could identify the SCP tables, as that's free data. Also look for the analog input table.

If you want to post your bin, and what you have for a dir file so far, I might see other hints.

[andyt12]

Yep, Ive identified the function and table lookups, Im a bit thrown by all the entries into the function lookups though. Ive also identified the AD table. Not sure about the SCP tables, its missing J1979 as it didn't have to comply with obdii, it does do J2190 though.

I think Ive identified the MAP, But Im not sure, when I calculate an address with a ram pointer Im 0x100 off, 0x63e would calculate to 0x73e.

Would the code reference 0x63E like so? I know 0x63E is changing when I simulate the MAP input.

LDW REG_62,#$0680 // Pointer setup in initialisation code
LDW REG_3C,$BE[REG_62] // Done just before the function lookup, REG_3C = 0x63E ?

Im reading the ram over the obdii with dmr. Maybe thats throwing the address off?

Ive attached my dir and bin, Ive labeled what I think is the MAP transfer, it would be great if you could take a look and confirm if Im on the right track or way off.

Thanks.

[mpaton]

Yep, Ive identified the function and table lookups, Im a bit thrown by all the entries into the function lookups though. Ive also identified the AD table. Not sure about the SCP tables, its missing J1979 as it didn't have to comply with obdii, it does do J2190 though.

I think Ive identified the MAP, But Im not sure, when I calculate an address with a ram pointer Im 0x100 off, 0x63e would calculate to 0x73e.

Would the code reference 0x63E like so? I know 0x63E is changing when I simulate the MAP input.

LDW REG_62,#$0680 // Pointer setup in initialisation code
LDW REG_3C,$BE[REG_62] // Done just before the function lookup, REG_3C = 0x63E ?

Im reading the ram over the obdii with dmr. Maybe thats throwing the address off?

Ive attached my dir and bin, Ive labeled what I think is the MAP transfer, it would be great if you could take a look and confirm if Im on the right track or way off.

Thanks.

0x63E might be MAP, I'm not certain yet.

However you did know that this machine does signed offset addressing didn't you.

So to add BE to 0680, the byte value is first sign extended to FFBE. Add that to 0680 and you get the discarded carry bit and 0x063E.
Maybe that's why you think you're 0x100 off.

[mpaton]

Ive attached my dir and bin, Ive labeled what I think is the MAP transfer, it would be great if you could take a look and confirm if Im on the right track or way off.

Thanks.

0x63E might be MAP, I'm not certain yet.

You are on the right track. 063E is an analog input, and it is one of the 3 that are read in the foreground, ie, at more frequent regular intervals. Mass airflow systems always read the MAF this way, so it's probable that 0x063E is viewed as needing frequent updates.

I did forget another technique that I find useful, and that's to check the error code functions. 0x063E as an analog input is checked against several constants, and bad values can set codes 490, 492 and 512. If those are MAP faults, then you've found it. These are 3 digit decimal codes, not OBD2 P codes, but also not the same as the US Ford 3 digit OBD-1 codes