I've located both of the 160 baud datastreams in $1F but known ram variables are in short supply.

The 4 byte Corvette dash table (which could be used as a 0-7 byte custom mini table in normal mode) and the 24 byte (ALDL) transmit table variables are known along with MW2 (which is common for both), but it would be nice to customize each table with some more useful variables for different purposes.

Does anyone have a (good) list of the ram variables for $1F besides what is already known?

We will likely be logging 24 byte (overlapping) blocks of ram addresses, but it will take around 20+ custom bins and 20+ logs to capture all of the data for analysis.

I don't have an 85 car so this is just an academic side project, but it may still benefit the few diehard $1F guys (if there are any left).

Known $1F ram addresses in order:

00 03 MCUINST
00 0E MWFA1
00 17 NTRPMX
00 1D Coolant Temp

00 1F MAT
00 25 Vehicle Speed (msb)
00 2F O2
00 40 TPS

00 60 Not used (unknown)
00 66 Knock Counts (Likely OLDPA3 msb)
00 6A Knock Retard
00 7E BLM

00 82 BPW
00 83 lsb

00 86 INT or CORRCL

00 A6 MAF
00 A7 lsb

00 AE O2 Crossover
00 CB EGR DC
00 D6 Running Fuel (msb)
00 D8 Running Distance

00 E7 (error flag1)
00 E8 (error flag2)
00 E9 (error flag3)
00 FE IAC

 

If it were me I’d use graph view to visually look at the logic used to make the ram variables to compare to better defined masks. GM probably uses similar enough code blocks. And I’d bet the list of them is pretty similar just maybe different order. I’ve done this before to very quickly find variables.

 

One other thing that I do if it helps at all…

I have tunerpro scalars that directly edit the aldl feed so I can swap out datalog ing different variables and obviously test my custom code as well.

i also have patches setup for tuning/datalogging
say Im doing ve tuning, one patch shuts off egr/air etc and auto alters my aldl variable with just the patch applied.

I have patches that turn of BLMs to tune INT, turn on/off highway. All sorts of things to make a tuning bin file instant.

then when I’m done I turn off the patch and it reverts everything back on and swaps aldl feed back to whatever I want.

so you could setup a couple patches that auto swap out any aldl variables for different tuning sessions. I assume others do this but then you don’t have to worry about having one permanent aldl feed.

 

It looks like there's about a 50-70 byte offset between $32B ram addresses and $1F, so that's a clue as to where to start looking for a specific variable like SAREF.

Take the $32B ram address. subtract 70(decimal) and check the next 24 bytes.

Note: I've never been able to successfully disassemble $1F but may give it another go. I have a couple of old hard drives I need to check to see if I can find my old attempts at disassembling $1F many years ago.

I went ahead and disassembled HLH3200, but not sure if I can trust the output or if it will be of much help. There aren't very many ram variable references in the code (92) and it is difficult to find references to known rom variables.

If anybody has a well commented $1F disassembly it would be very helpful.

 

Here are a few ram address candidates for critical variables that need to be tested/verified:

00 01 MW2
00 23 LV8
00 62 SAREF
00 63 lsb
00 6A Knock Retard (confirmed)
00 7D BLM Cell
00 8E Target AFR
00 8F lsb
00 CE SAP
00 CF lsb