Getting started w/ disassembly and commenting
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
One thing Ive found with single fire is that the fuel tends to lag the engine demand due to the slow updates. I ran this mode with my first iteration of the MAF PFI code and one complaint was that the engine didnt respond to transitions well.
I ended up coding an adaptive fuel logic routine that runs the engine in single fire, but allows for makup injector pulses at low RPMs if the fueling demand changes a lot between the main injector firings. 95 4x4 is running it at the moment, but his WB is dead, so I havent gotten feedback yet as to how well it works, but it should at least in part solve some of the lag issues while still allowing a slower injector firing rate. See the $0D MAF PFI beta release thread on this board. I discuss the logic in the last few posts after I posted teh new code.
This, of course, is dependant on what the ECM can do. Yours may have the injector drivers controlled at the hardware level. In the TBI PCMs, the software can run the injector drivers directly and fire them whenever necessary.
I ended up coding an adaptive fuel logic routine that runs the engine in single fire, but allows for makup injector pulses at low RPMs if the fueling demand changes a lot between the main injector firings. 95 4x4 is running it at the moment, but his WB is dead, so I havent gotten feedback yet as to how well it works, but it should at least in part solve some of the lag issues while still allowing a slower injector firing rate. See the $0D MAF PFI beta release thread on this board. I discuss the logic in the last few posts after I posted teh new code.
This, of course, is dependant on what the ECM can do. Yours may have the injector drivers controlled at the hardware level. In the TBI PCMs, the software can run the injector drivers directly and fire them whenever necessary.
Last edited by dimented24x7; Mar 11, 2011 at 11:33 PM.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
was AE calculated differently or not at all in single-fire?
for a while i was actually considering making single-fire the default fueling mode(when i get it to work off of VE instead of Alpha-N), but now i'm kind of wary about it... i'm subscribed to and have read the MAF thread though i'm sure i could refresh my memory....
and i REALLY need to catch up with you smart guys on the board and learn exactly how the ECM/PCM really works.... i know 8D is very similar to A1 in repect to fueling and since they run on the same ECM, i assume that the little references i've found in 8D about writing to a certain register will cause an injector pulse regardless of when the last DRP was hold true in A1 as well...
for a while i was actually considering making single-fire the default fueling mode(when i get it to work off of VE instead of Alpha-N), but now i'm kind of wary about it... i'm subscribed to and have read the MAF thread though i'm sure i could refresh my memory....
and i REALLY need to catch up with you smart guys on the board and learn exactly how the ECM/PCM really works.... i know 8D is very similar to A1 in repect to fueling and since they run on the same ECM, i assume that the little references i've found in 8D about writing to a certain register will cause an injector pulse regardless of when the last DRP was hold true in A1 as well...
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
The crank/run fueling and AE are calculated for each individual cylinder in terms of required fuel mass, so the cal will work for an arbitrary cylinder count without changing the fueling logic.
The PCM then delivers the fueling in 1x mode, then tracks the required pulsewidth and delivered pulsewidth between each firing. If the pulsewidth increases significantly, the PCM then delivers makeup pulses between firings, with the PW being based on the required total fuel delivered vs. # of cylinders remaining to fire, assuming there is sufficient PW to fire the injectors.
The PCM then delivers the fueling in 1x mode, then tracks the required pulsewidth and delivered pulsewidth between each firing. If the pulsewidth increases significantly, the PCM then delivers makeup pulses between firings, with the PW being based on the required total fuel delivered vs. # of cylinders remaining to fire, assuming there is sufficient PW to fire the injectors.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
quite a bit of progress has been made since my last post, but of course, more questions come up now. 
single-fire fueling(refered to by GM as "Quasi-sync") seems to working great in A1 without any significant code or calibration changes, just a bit of playing around with the values that determine double-fire vs single allowed it. i can run up to a ~7mSec pulse in single-fire before getting close to the time limit i have to deal with before the next cycle comes around and the ECM cuts the BPW to 0.
but now, i recently had the thought of bypassing the section of the code after it checks to see if the flip/flop bit was set or cleared to see if it's a fire or no-fire cycle, and prevent the no-fire portion of it, allowing for single-fire fueling to be used at any RPM or pulsewidth without the fear of being cut off.
so, i did a simple branch around the clear A/B, store D to 3FD0 and just jumped straight into the portion where it changes the flip/flop to show the fire/no-fire status.
it seems that causes roughly double the amount of fuel to be delivered, rather than my intended effect.
so, my question is this: when 3FD0 is written to, it's not so much of a "timer" value that's written and then immediately executed, is it? i was assuming that when it was written to, there would instantly be an injector pulse for the duration based on the value that was written to it. now, it would seem to me that writing to it only determines how long the injectors will be open, not when they are fired. it seems that is handled elsewhere? if so, then i would have another question... and if not, maybe someone can point me in the right direction as to how it actually works.
single-fire fueling(refered to by GM as "Quasi-sync") seems to working great in A1 without any significant code or calibration changes, just a bit of playing around with the values that determine double-fire vs single allowed it. i can run up to a ~7mSec pulse in single-fire before getting close to the time limit i have to deal with before the next cycle comes around and the ECM cuts the BPW to 0.
but now, i recently had the thought of bypassing the section of the code after it checks to see if the flip/flop bit was set or cleared to see if it's a fire or no-fire cycle, and prevent the no-fire portion of it, allowing for single-fire fueling to be used at any RPM or pulsewidth without the fear of being cut off.
so, i did a simple branch around the clear A/B, store D to 3FD0 and just jumped straight into the portion where it changes the flip/flop to show the fire/no-fire status.
it seems that causes roughly double the amount of fuel to be delivered, rather than my intended effect.
so, my question is this: when 3FD0 is written to, it's not so much of a "timer" value that's written and then immediately executed, is it? i was assuming that when it was written to, there would instantly be an injector pulse for the duration based on the value that was written to it. now, it would seem to me that writing to it only determines how long the injectors will be open, not when they are fired. it seems that is handled elsewhere? if so, then i would have another question... and if not, maybe someone can point me in the right direction as to how it actually works.
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
How is the routine called? Is it in a routine called by an interrupt from the DRP pulses? That can tell a lot about how it works. Also, how did the flag effect the fueling? Did it cause a skip on alternate passes that basically did not save the PW, or simply cleared it?
Odds are if its just a save to a hardware address, the PW is simply saved, and then outputted at the hardware level on each DRP. The value saved is then just the time the injectors will be kept open. In the TBI PCM, the injector driver outputs actually have to be set up using interrupts, so theres a lot more than just a simple save. You start by calling the interrupt and saving the desired firing time, which then calls another exit interrupt to shut down the injectors once the firing is done. The control is done using two of the timer output compare lines.
Another option that you could use if you want arbitrary control over the fueling is the async PW accumulator. On many computers, that simply turns on the injectors whenever its written to for the specified ammount of time. If you have a DRP interrupt, then you can use the async to drive the injectors.
Odds are if its just a save to a hardware address, the PW is simply saved, and then outputted at the hardware level on each DRP. The value saved is then just the time the injectors will be kept open. In the TBI PCM, the injector driver outputs actually have to be set up using interrupts, so theres a lot more than just a simple save. You start by calling the interrupt and saving the desired firing time, which then calls another exit interrupt to shut down the injectors once the firing is done. The control is done using two of the timer output compare lines.
Another option that you could use if you want arbitrary control over the fueling is the async PW accumulator. On many computers, that simply turns on the injectors whenever its written to for the specified ammount of time. If you have a DRP interrupt, then you can use the async to drive the injectors.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
i'm actually not certain how it gets called, i'm still new to learning exactly how the hardware inferaces with the software.
i can tell you it's pretty close to the beginning of the code (algorithm starts at A000, this code starts at A325, vectors FFF8-FFFE all point to A000, and FFF2 points to A21F). here is how i have understood it to work in A1:
obviously, i still have some stuff to decode.
now, from what i can tell, the ECM sets up a couple of bits, one is used to filter the first single-fire pulse, another is used to flip/flop to determine if it's a fire or no fire cycle. on a no-fire cycle, it clears A and B, and stores that to the injector register. on a fire cycle, it takes the "fuel required" calc, doubles it, adds in the battery voltage offsets, etc, and eventually writes to the injector register.
now, i thought that by bypassing the clear/store operation on a non-fire cycle, it would allow more than 1 full revolution to inject fuel, instead it seems that i caused double-fire events using single-fire pulse width, so lots of extra fuel.
"Odds are if its just a save to a hardware address, the PW is simply saved, and then outputted at the hardware level on each DRP. The value saved is then just the time the injectors will be kept open."
this is the conclusion i came to earlier.
i can tell you it's pretty close to the beginning of the code (algorithm starts at A000, this code starts at A325, vectors FFF8-FFFE all point to A000, and FFF2 points to A21F). here is how i have understood it to work in A1:
Code:
ROM:A325 brclr byte_43 $10 loc_A390 ; Air/Fuel Mode Byte ROM:A325 ; 0 ARSEN DIVERT FLAG 1=DIVERT ROM:A325 ; 1 LEARN CONTROL ENABLE FLAG 1=ENABLE ROM:A325 ; 2 SLOW O2 RICH LEAN FLAG ROM:A325 ; 3 1 = 'DELIVER FUEL ON EVERY REF' ACTIVE ROM:A325 ; 4 QUASI-SYNCHNONOUS PULSE FLAG (QAP FLAG) (SINGLE FIRE!) ROM:A325 ; 5 1 = INITIAL SAM LEARN DELAY TIME EXPIRED ROM:A325 ; 6 RICH LEAN FLAG 1 = RICH 0 = LEAN ROM:A325 ; 7 1 = IN CLOSED LOOP, 0 = OPEN LOOP ROM:A329 sei ; do not allow interrupts ROM:A32A brclr byte_2F $40 loc_A390 ; '@' ; bits ROM:A32A ; b5 for coolant temp delta enough for ESC enable? ROM:A32A ; b6 clear = makes single fire impossible ROM:A32E brset byte_30 $80 loc_A34D ; 'Ç' ; b7 set = first single-fire pulse done ROM:A32E ; b6 = flip/flop for single-fire inject/no inject logic ROM:A332 bset byte_30 $80 ; 'Ç' ; b7 set = first single-fire pulse done ROM:A332 ; b6 = flip/flop for single-fire inject/no inject logic ROM:A335 ldab byte_62 ; Engine Speed ROM:A335 ; RPM = N*25 ROM:A337 lsrb ; string causes a div by 16(17 values in table) ROM:A337 ; (0 + 6400/16 (400)) ROM:A338 lsrb ROM:A339 lsrb ROM:A33A lsrb ROM:A33B adcb #0 ; round to nearest 400 ROM:A33D ldx #$89BA ; MULTIPLIER FOR 1ST QSYNCH PULSE ROM:A340 abx ; add B to X, causing X to point to closest 400 RPM value ROM:A341 ldaa 0,x ; load the value X is pointing at into A ROM:A343 ldx #$8B ; 'ï' ; point X to fuel required value ROM:A346 jsr Multiply8X16 ; do multiplier for fuel requirement ROM:A349 std byte_8B ; fuel required calc ROM:A34B bra loc_A35E ROM:A34D ; --------------------------------------------------------------------------- ROM:A34D ROM:A34D loc_A34D: ; CODE XREF: ROM:A32Ej ROM:A34D brclr byte_30 $40 loc_A35E ; '@' ; b7 set = first single-fire pulse done ROM:A34D ; b6 = flip/flop for single-fire inject/no inject logic ROM:A351 clra ; make BPW 0 for this cycle ROM:A352 clrb ROM:A353 std word_3FD0 ; injector BPW register ROM:A356 std word_146 ; final BPW gets copied here ROM:A359 bclr byte_30 $40 ; '@' ; b7 set = first single-fire pulse done ROM:A359 ; b6 = flip/flop for single-fire inject/no inject logic ROM:A35C bra loc_A390 ROM:A35E ; --------------------------------------------------------------------------- ROM:A35E ROM:A35E loc_A35E: ; CODE XREF: ROM:A34Bj ROM:A35E ; ROM:loc_A34Dj ROM:A35E bset byte_30 $40 ; '@' ; b7 set = first single-fire pulse done ROM:A35E ; b6 = flip/flop for single-fire inject/no inject logic ROM:A361 ldd byte_8B ; fuel required calc ROM:A363 lsld ; multiply by 2 (since double fuel will be delivered ROM:A363 ; every other stroke) ROM:A364 bcc loc_A369 ; branch if no overflow ROM:A366 ldd #$7FFF ; otherwise, limit ROM:A369 ROM:A369 loc_A369: ; CODE XREF: ROM:A364j ROM:A369 std word_146 ; final BPW gets copied here ROM:A36C tsta ROM:A36D bne loc_A383 ROM:A36F tba ROM:A370 tsta ROM:A371 beq loc_A38A ROM:A373 ldab #$20 ; ' ' ROM:A375 ldx #$89CB ; injector offset vs BPW ROM:A378 jsr lookup_2D_with_offset ROM:A37B tab ROM:A37C clra ROM:A37D addd byte_8B ; fuel required calc ROM:A37F addd byte_8B ; fuel required calc ROM:A381 bcs loc_A387 ROM:A383 ROM:A383 loc_A383: ; CODE XREF: ROM:A36Dj ROM:A383 addd word_F6 ; current injector offset vs fuel pump volts value ROM:A385 bcc loc_A38A ROM:A387 ROM:A387 loc_A387: ; CODE XREF: ROM:A381j ROM:A387 ldd #$7FFF ROM:A38A ROM:A38A loc_A38A: ; CODE XREF: ROM:A371j ROM:A38A ; ROM:A385j ROM:A38A std word_3FD0 ; injector BPW register ROM:A38D std word_476 ; final BPW for HUD ROM:A390 ROM:A390 loc_A390: ; CODE XREF: ROM:loc_A325j ROM:A390 ; ROM:A32Aj ... ROM:A390 bclr byte_2F $40 ; '@' ; bits ROM:A390 ; b5 for coolant temp delta enough for ESC enable? ROM:A390 ; b6 clear = makes single fire impossible ROM:A393 cli ; re-allow interrupts ROM:A394 brclr byte_2A $20 loc_A39B ; ' ' ; do not allow interrupts ROM:A398 bclr byte_2C 4 ; General Mode Byte 2 ROM:A398 ; 0 LAST LOOP VALUE OF TPS BYPASS FLAG ( TPS LOAD SUBR. ) ROM:A398 ; 1 TPS BYPASS FLAGER EXERCISE FLAG ROM:A398 ; 2 1 = REFERENCE PULSE OCCURRED (6.25 MS CHECK) ( TPS LOAD SUBR. ) ROM:A398 ; 3 1 = DIAGNOSTIC SWITCH IN FACTORY TEST POSITION ROM:A398 ; 4 1 = DIAGNOSTIC SWITCH IN DIAGNOSTIC POSITION ROM:A398 ; 5 1 = DIAGNOSTIC SWITCH IN ALDL POSITION ROM:A398 ; 6 1 = HIGH BATTERY VOLTAGE - DISABLE SOLENOID DISCRETES ROM:A398 ; 7 1 = IDLE CONDITIONS MET (BLM LOGIC) ROM:A39B ROM:A39B loc_A39B: ; CODE XREF: ROM:A394j ROM:A39B sei ; do not allow interrupts
obviously, i still have some stuff to decode.
now, from what i can tell, the ECM sets up a couple of bits, one is used to filter the first single-fire pulse, another is used to flip/flop to determine if it's a fire or no fire cycle. on a no-fire cycle, it clears A and B, and stores that to the injector register. on a fire cycle, it takes the "fuel required" calc, doubles it, adds in the battery voltage offsets, etc, and eventually writes to the injector register.
now, i thought that by bypassing the clear/store operation on a non-fire cycle, it would allow more than 1 full revolution to inject fuel, instead it seems that i caused double-fire events using single-fire pulse width, so lots of extra fuel.
"Odds are if its just a save to a hardware address, the PW is simply saved, and then outputted at the hardware level on each DRP. The value saved is then just the time the injectors will be kept open."
this is the conclusion i came to earlier.
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
The only way to really tell if its just a save to hardware, that is then outputted on the next DRP would be to test it on the bench. You can feed the ECM a slow square wave signal (1-3 Hz) thru the ESC input, and then output some value to the PW hardware address in another low speed routine thats run at 10 Hz. If the injector drivers fire with the test signal, then its DRP controlled. If they fire at the rate that you save the address, then its an async type output.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
seems i finally have a good reason to assemble the bench then...
i have to wonder if a speed that slow will cause the cranking fuel stuff to interfere though...
i have to wonder if a speed that slow will cause the cranking fuel stuff to interfere though...
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: Getting started w/ disassembly and commenting
RBob.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
hmm... that should work... i may have to adjust at least one value in the tune down to nearly nothing(Maximum RPM for Start-Up Fuel), but after that it should work..... i think. 
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
I wouldnt try it on a running vehicle. If you dont have a bench, a simple 555 timer circuit can suffice to test it with the ECM still installed in the car. You then just rig the signal in at the dist. to the appropriate lead. Just make sure to disconnect the fuel pump relay, coil, and injectors so they wont be triggered when you feed the ECM the test signal. I cant remember off the top of my head which pin to use at the dist., though. I think its the IC high reference, but maybe someone can verify.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
i NEED to build a bench anyways... i've got too much custom code in the works to try and test in on a real vehicle, it was scary enough when the somewhat tested 400-8400 VE and spark tables were getting tested for the first time.
i'm also dealing with DIS, so i'll find out one way or another if it's my 3X high or low circuit. i don't see anything getting dammaged if i hook it up to the wrong one.
i'm also dealing with DIS, so i'll find out one way or another if it's my 3X high or low circuit. i don't see anything getting dammaged if i hook it up to the wrong one.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
okay, went over what i know about the 7727 a few times and it looks like to play with everything possible that i want with a 7727 style ECM(i'm using a 16149396 in reality), i'll need 25 LEDs, 12 potentiometers, 17 switches and 5 or 6 555 circuits. that would allow me to play with nearly every pin on the connectors.
question: i'm eventually wanting to run closed loop control on the GM 3500 and 3900 cam phaser systems, and since their amount of advance/retard is controlled simply by changing duty cycles, i'd like to run a cam sensor to keep track of and allow accurate correction of the duty cycle to maintain a desired amount of advance/retard. now for testbench purposes, i would need some type of hardware that will only trigger once every 6 pulses(2 revolutions, since the classic 60V6 ICM takes a 7X signal and makes a 3X signal) on a specific pin. is there any REALLY common hardware used to do this(i believe they are called flip-flops/latches)? something i could find when looking at somewhere with as general a selection of components as say Radioshack?
other than that SNAFU, that's about the only thing stopping me from ordering parts to get this built and testing the quasi-sync stuff mentioned earlier, and then onto more complex code stuff.
eventually, all of the 555s will be replaced with a PIC(or two) RBob mentioned before in my thread with questions about testbenches(this post would go there, but since there are specific questions that pertain to this thread, i thought it more appropriate), but for now, i just need a simple solution that doesn't need PROM burners to make changes to, i'll have to suppliment my BURN2 in the future soon enough.
question: i'm eventually wanting to run closed loop control on the GM 3500 and 3900 cam phaser systems, and since their amount of advance/retard is controlled simply by changing duty cycles, i'd like to run a cam sensor to keep track of and allow accurate correction of the duty cycle to maintain a desired amount of advance/retard. now for testbench purposes, i would need some type of hardware that will only trigger once every 6 pulses(2 revolutions, since the classic 60V6 ICM takes a 7X signal and makes a 3X signal) on a specific pin. is there any REALLY common hardware used to do this(i believe they are called flip-flops/latches)? something i could find when looking at somewhere with as general a selection of components as say Radioshack?
other than that SNAFU, that's about the only thing stopping me from ordering parts to get this built and testing the quasi-sync stuff mentioned earlier, and then onto more complex code stuff.
eventually, all of the 555s will be replaced with a PIC(or two) RBob mentioned before in my thread with questions about testbenches(this post would go there, but since there are specific questions that pertain to this thread, i thought it more appropriate), but for now, i just need a simple solution that doesn't need PROM burners to make changes to, i'll have to suppliment my BURN2 in the future soon enough.
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
Flip/flops can only do divides by 2 to some power. Maybe a binary counter with its output pins hooked to logic gates. Basically once you get the correct binary combination for 6, you trigger a 555 wired up as a monostable to output a pulse and reset the counter for the next output.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
what would be a common part number for a binary counter capable of that? i'm incredibly new to the whole concept.
and with a 555 setup as multistable, would any of the component values have to change when i change RPM on a different 555, or will it account for that?
and with a 555 setup as multistable, would any of the component values have to change when i change RPM on a different 555, or will it account for that?
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
i did a search on the Tayda electronics site, since they've been consitently offering the best price on all the random little electronic stuff i need, found a couple of descriptions that sound like what i'm looking for....
7490 decade counter? according to the datasheet, it can do anything from 0-9?
74163 4 bit binary counter? not sure about this one, datasheet is a bit more cryptic.
74393 dual 4 bit binary counter? 0-15 from the looks of it.
4017 decade counter? 0 through 9?
4026 decade counter? not sure, hard to read the datasheet.
7490 decade counter? according to the datasheet, it can do anything from 0-9?
74163 4 bit binary counter? not sure about this one, datasheet is a bit more cryptic.
74393 dual 4 bit binary counter? 0-15 from the looks of it.
4017 decade counter? 0 through 9?
4026 decade counter? not sure, hard to read the datasheet.
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
Its been a while since Ive screwed around with this stuff, but the 4-bit counter should work for your purposes. Basically you only have to count to 5 or 6, depending on how its wired, and then use the appropriate logic gates to signal the 555 to output a pulse. You want it as an astable multivibrator as you only need one pulse per 6 reference pulses. The pulsewidth can then be set for something like 50 or 60% of the total period at the maximum RPM you want to simulate. I have an old book on 555's that has some circuits for counters and so forth. Let me see if it has anything useful in it that I can scan in.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
logic gates? now i'm really reeling.
max RPM i would be simulating would be somewhere near 6400 RPM.... and at 3 pulses per revolution, that works out to somewhere around 320Hz.
max RPM i would be simulating would be somewhere near 6400 RPM.... and at 3 pulses per revolution, that works out to somewhere around 320Hz.
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
Yeah, you need some way to know when the counter has gotten to the appropriate value. This can be done by tying its outputs into logic gates. As to which ones you'll need, Im not sure offhand. There may be a simpler way to do it, but Im not an EE so I cant be of much help on alternate designs.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
i actually looked into the concept of logic gates and i have a pretty good idea of how they work, and i even found a decent simulator, though i have yet to determine how to emulate the chip...
and as stated, the datasheet i found for the 4 bit counter isn't very friendly, but if i can figure out the pinouts, with enough time in the sim, i should be able to get a chain that gives me what i want...
and as stated, the datasheet i found for the 4 bit counter isn't very friendly, but if i can figure out the pinouts, with enough time in the sim, i should be able to get a chain that gives me what i want...
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
had some spare time today and looked over the datasheets again, i'm really liking the 4017 setup.... it seems to do all of the logic gate type stuff internally?
http://www.taydaelectronics.com/datasheets/A-020.pdf
if so, that's all kinds of awesome for me since the datasheet is very newb friendly, and at a cost of $.30 each, i really can't complain about them. i don't see myself using the clock-inhibit for anything, and if i'm reading this correctly, the carry-out won't be needed for my /6 requirement either, so it actually seems to be very easy to use for this....
and from the sounds of it, i'll need the 555 i'm using to simulate a crank sensor to feed both the ECM and the clock pin on the counter chip, then connect the "divided by 6" output pin to both the pin on the 7727 i'm planning on using for a cam sensor, and also connected to the trigger on another 555 circuit(monostable), which will then give a pulse on it's output pin, which will need to be connected to the reset pin on the counter...
correct me if i'm wrong, but this sounds incredibly easy? i get the feeling i'm missing something.
http://www.taydaelectronics.com/datasheets/A-020.pdf
if so, that's all kinds of awesome for me since the datasheet is very newb friendly, and at a cost of $.30 each, i really can't complain about them. i don't see myself using the clock-inhibit for anything, and if i'm reading this correctly, the carry-out won't be needed for my /6 requirement either, so it actually seems to be very easy to use for this....
and from the sounds of it, i'll need the 555 i'm using to simulate a crank sensor to feed both the ECM and the clock pin on the counter chip, then connect the "divided by 6" output pin to both the pin on the 7727 i'm planning on using for a cam sensor, and also connected to the trigger on another 555 circuit(monostable), which will then give a pulse on it's output pin, which will need to be connected to the reset pin on the counter...
correct me if i'm wrong, but this sounds incredibly easy? i get the feeling i'm missing something.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
another quick question since i'm now very certain i can do what i suggested in my last post:
how can i simulate an O2 sensor while having both the high/low time ratios adjustable and be independant of O2 swinging frequency?
i was originally planning on just using another 555 and setting the duty cycle to as close to 50% as possible and just setting a believable and non-adjustable O2 swing frequency(i figured somewhere between 8 and 16Hz would be fine), but the everlasting urge to tweak and modify has me wanting to be able to adjust both independantly....
how can i simulate an O2 sensor while having both the high/low time ratios adjustable and be independant of O2 swinging frequency?
i was originally planning on just using another 555 and setting the duty cycle to as close to 50% as possible and just setting a believable and non-adjustable O2 swing frequency(i figured somewhere between 8 and 16Hz would be fine), but the everlasting urge to tweak and modify has me wanting to be able to adjust both independantly....
Supreme Member
iTrader: (2)
Joined: Jan 2002
Posts: 9,962
Likes: 5
From: Moorestown, NJ
Car: 88 Camaro SC
Engine: SFI'd 350
Transmission: TKO 500
Axle/Gears: 9-bolt w/ 3.23's
Re: Getting started w/ disassembly and commenting
You could use a ramp generator that ramps the voltage up and down in a sawtooth fashion to simulate an O2. There are 555 timer circuits that do this as well. I can scan one in if you want. Might be better than using a square wave as you will be able to also observe the prop. and integral term action as well as the O2 volts vary. With a square wave, it will be all or nothing. The frequency should also be fairly low. I dont think O2s cross count at more than 4 Hz or so.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
hmm.... i didn't know a 555 could generate anything other than a square wave..... on it's own anyways.
from what i've seen in my datalogs, under normal circumstances and in closed loop, it generates more or less a square wave with slightly rounded falling and rising edges....
higher airflow(or at least higher RPM) situations tended to make the switching frequency go a bit quicker as well... i log at ~10.67Hz and i've had quite a few instances where the O2 mV will show significantly above my stoich switch point in one sample and be significantly lower in the next and keeps repeating. that would imply my O2 switches near ~5.3Hz at least in those situations.
from what i've seen in my datalogs, under normal circumstances and in closed loop, it generates more or less a square wave with slightly rounded falling and rising edges....
higher airflow(or at least higher RPM) situations tended to make the switching frequency go a bit quicker as well... i log at ~10.67Hz and i've had quite a few instances where the O2 mV will show significantly above my stoich switch point in one sample and be significantly lower in the next and keeps repeating. that would imply my O2 switches near ~5.3Hz at least in those situations.
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: Getting started w/ disassembly and commenting
What I did on the early ECM benches was to use the 555 output. Run it through a resistor then filter with a capacitor. Basically integrating the signal to provide more of a sine wave. The other thing is that a 555 doesn't really provide a 50% duty cycle, so maybe run it through a flip flop for that.
Then level shifted and limited the signal with a resistor dividing network. It works to prevent a SES/CEL, and allows closed loop. But expect the INT/BLM to go one way or the other.
Even with a fancy uProc simulated O2 signal this will occur. Without using ECM feedback it is difficult to find the right O2 swing. Note that a NB O2 will swing further on the rich side then the lean side. There is a calibration parameter to even this out for the firmware calc.
RBob.
Then level shifted and limited the signal with a resistor dividing network. It works to prevent a SES/CEL, and allows closed loop. But expect the INT/BLM to go one way or the other.
Even with a fancy uProc simulated O2 signal this will occur. Without using ECM feedback it is difficult to find the right O2 swing. Note that a NB O2 will swing further on the rich side then the lean side. There is a calibration parameter to even this out for the firmware calc.
RBob.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
using what's more or less a 555 with a flip-flop(and the resistor/cap filter), how feasible is it to use a pair of pots, 1 connected to a ~1volt source, another connected to ground, and use those to more or less bias the signal the 555/flip-flop would be making?
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: Getting started w/ disassembly and commenting
RBob.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
would this pot be connected in series between the resistor/cap filter and the pin on the PCM, or elsewhere?
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
as i wait for my parts to arrive for my bench, i find i have another question:
any tricks for determining exactly what certain subroutines do? i'm referring mainly to all of the math intensive ones. i've shifted some of my time to dealing with the 94-95 3100/3.4 iron head PCMs(dual P66 units with 32KB flash PROMs), and there are some incredibly convoluted subroutines for dealing with the transmission, tables of LDX locations within LDX locations, more subroutines within subroutines, etc...
i can't really wrap my head around some of them. some of the easier ones to pick out were 2D and 3D lookups due to how the algorithm around them was setup, eventually figured out the 16 bit 3D lookup stuff as well(why GM decided to have 16 bit VE tables that seem to reach near 5000%, i'll never know).
filtering subroutines were simple to figure out as well from the way the results were handled.
stuff like "16 bit by 16 bit fixed point multiply" i would have never guessed without looking back at some of the more well-defined hacks, but there is code on these V6 PCMs that i've never seen elsewhere.
about the only method i've been able to have any success with is to plug in random values and change one at a time to see what effect they have on the results, but that takes a long time to do and doesn't work a lot of the time anyways.
any tricks for determining exactly what certain subroutines do? i'm referring mainly to all of the math intensive ones. i've shifted some of my time to dealing with the 94-95 3100/3.4 iron head PCMs(dual P66 units with 32KB flash PROMs), and there are some incredibly convoluted subroutines for dealing with the transmission, tables of LDX locations within LDX locations, more subroutines within subroutines, etc...
i can't really wrap my head around some of them. some of the easier ones to pick out were 2D and 3D lookups due to how the algorithm around them was setup, eventually figured out the 16 bit 3D lookup stuff as well(why GM decided to have 16 bit VE tables that seem to reach near 5000%, i'll never know).
filtering subroutines were simple to figure out as well from the way the results were handled.
stuff like "16 bit by 16 bit fixed point multiply" i would have never guessed without looking back at some of the more well-defined hacks, but there is code on these V6 PCMs that i've never seen elsewhere.
about the only method i've been able to have any success with is to plug in random values and change one at a time to see what effect they have on the results, but that takes a long time to do and doesn't work a lot of the time anyways.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
another portion of long-time, no-update.
however, plenty of progress IMO.
i've successfully disassembled and commented on the entire calibrations of the 6D, 88, 8F masks using A1/DF as a basis(with the exception of a few bytes in 6D/8F related to EGR that i still can't wrap my head around), something i've been messing around with in between writing code for my nAst1 project.
while i haven't been making (too many) mistakes pounding everything out in a hex editor, i'd like to get working with an actual assembler. the one recommended by Dimented24x7 seems to be working for me, which is an exception to the rule since i'm running a 64 bit OS and otherwise need to use DOSBox. however, there seem to be some quirks to it? i have the AUJPVE2X files and attempted to make a S19 file from them using the MGTEK program and while it created a LST and S19 file from the ASM file, both files were quite different from the LST and S19 files provided in that ZIP.
is this something i should be worrying about or is it just due to that ASM file probably not being written intended to be used with that specific assembler?
however, plenty of progress IMO.
i've successfully disassembled and commented on the entire calibrations of the 6D, 88, 8F masks using A1/DF as a basis(with the exception of a few bytes in 6D/8F related to EGR that i still can't wrap my head around), something i've been messing around with in between writing code for my nAst1 project.
while i haven't been making (too many) mistakes pounding everything out in a hex editor, i'd like to get working with an actual assembler. the one recommended by Dimented24x7 seems to be working for me, which is an exception to the rule since i'm running a 64 bit OS and otherwise need to use DOSBox. however, there seem to be some quirks to it? i have the AUJPVE2X files and attempted to make a S19 file from them using the MGTEK program and while it created a LST and S19 file from the ASM file, both files were quite different from the LST and S19 files provided in that ZIP.
is this something i should be worrying about or is it just due to that ASM file probably not being written intended to be used with that specific assembler?
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: Getting started w/ disassembly and commenting
another portion of long-time, no-update.
however, plenty of progress IMO.
i've successfully disassembled and commented on the entire calibrations of the 6D, 88, 8F masks using A1/DF as a basis(with the exception of a few bytes in 6D/8F related to EGR that i still can't wrap my head around), something i've been messing around with in between writing code for my nAst1 project.
while i haven't been making (too many) mistakes pounding everything out in a hex editor, i'd like to get working with an actual assembler. the one recommended by Dimented24x7 seems to be working for me, which is an exception to the rule since i'm running a 64 bit OS and otherwise need to use DOSBox. however, there seem to be some quirks to it? i have the AUJPVE2X files and attempted to make a S19 file from them using the MGTEK program and while it created a LST and S19 file from the ASM file, both files were quite different from the LST and S19 files provided in that ZIP.
is this something i should be worrying about or is it just due to that ASM file probably not being written intended to be used with that specific assembler?
however, plenty of progress IMO.
i've successfully disassembled and commented on the entire calibrations of the 6D, 88, 8F masks using A1/DF as a basis(with the exception of a few bytes in 6D/8F related to EGR that i still can't wrap my head around), something i've been messing around with in between writing code for my nAst1 project.
while i haven't been making (too many) mistakes pounding everything out in a hex editor, i'd like to get working with an actual assembler. the one recommended by Dimented24x7 seems to be working for me, which is an exception to the rule since i'm running a 64 bit OS and otherwise need to use DOSBox. however, there seem to be some quirks to it? i have the AUJPVE2X files and attempted to make a S19 file from them using the MGTEK program and while it created a LST and S19 file from the ASM file, both files were quite different from the LST and S19 files provided in that ZIP.
is this something i should be worrying about or is it just due to that ASM file probably not being written intended to be used with that specific assembler?
The LST file can be quite different as it also includes comments and such.
The S19 should be similar. Check the byte ordering as Motorola is big-endian while Intel is little-endian. The other item is the length of the data on each line. If it varies between the two then they will show up differently. But the end result (the BIN) should match.
RBob.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
the 8F hack i came across had a few errors in it and portions of calibration that were completely missing actually. there is a set of values used to turn the fan on and off based on MAP, and how long the engine has been above or below a threshold determining if the fan should be on or off. essentially, when at/near boost, a timer starts incrementing and when it reaches whatever threshold, the fan comes on, when below boost but above ~40kPa, the timer stops moving, and when ~40kPa and lower, the timer decrements, and when below whatever threshold, the fan goes off.
interesting section of code, to say the least.
IIRC, your disassembly of $88 had some unknown sections as well? anyways, 88 is identical to A1 with the exception of some organization differences.
and 6D, i don't think i've ever run across a disassembly for it, but it's obviously similar to $88, but there were a few significant differences. i made that one specifically to grab a few calibrations that were only on 6D to convert them to A1.
i'll have to grab an umodified AUJP, apply both patches and see if the files match by the end.
interesting section of code, to say the least.
IIRC, your disassembly of $88 had some unknown sections as well? anyways, 88 is identical to A1 with the exception of some organization differences.
and 6D, i don't think i've ever run across a disassembly for it, but it's obviously similar to $88, but there were a few significant differences. i made that one specifically to grab a few calibrations that were only on 6D to convert them to A1.
i'll have to grab an umodified AUJP, apply both patches and see if the files match by the end.
Thread Starter
Senior Member
Joined: Nov 2006
Posts: 672
Likes: 1
From: Camden, MI
Car: 1985 IROC-Z28
Engine: LB9
Transmission: 700R4
Axle/Gears: 3.73
Re: Getting started w/ disassembly and commenting
ok, did some testing. even though the S19 files themselves seemed to be significantly different, the resulting BINs were identical....
weird.
anyways, once i put in the correct offset(did 0 the first time, 8000 the 2nd) for the S19_pat_, both files came out correct, so the MGTEK assembler seems to be working 100% for me, now i just need to see how it likes it's input to be formatted.
weird.
anyways, once i put in the correct offset(did 0 the first time, 8000 the 2nd) for the S19_pat_, both files came out correct, so the MGTEK assembler seems to be working 100% for me, now i just need to see how it likes it's input to be formatted.
Thread
Thread Starter
Forum
Replies
Last Post
Elephantismo
Electronics
14
Feb 13, 2019 12:51 AM
