Idiots guide to disassembly and reading opcode...

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 12:44 am

Port6 bit 0 goes via PU4424 and controls the supercharger vacuum control solenoid

Port6 bit 1 goes via PU4424 and controls the 'monitor and check lamp - green'
Port6 bit 2 goes via PU4424 and controls the 'monitor and check lamp - red'
Port6 bit 3 goes via PU4424 and controls the 'idle up solenoid'
Port6 bit 4 goes via 2SD1323 and controls the supercharger solenoid stopper valve

Port6 bit 5 goes via PU4424 and controls the supercharger vacuum tank solenoid

Port6 bit 6 goes via PU4424 and controls the supercharger bypass control solenoid

Port6 bit 7 goes to a uPC1074G which appears to be a hardware watchdog timer.

Pin6 from the JECS A19 chip is what controls the supercharger clutch. <<< Unfortunately its not on the same port as the rest of the supercharger controls

Also, at about 4000 RPM is where the supercharger drops OUT, after this point it is assumed that the turbo will be on boost and needs no assistance.

It appears to be based ONLY on throttle position and RPM. It doesn't seem that TP load has ANYTHING to do with it.

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 2:33 am

Oh another thing is the RPM limiter is a word x 12.5 rather than byte x 50. I don't know weather the supercharger cut point may also be the same or not.

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 6:11 am

Haha, that was quick.

I took a quick glance at it this morning, and from what I gather you mainly need the control of the superchargers clutch.

Those unknown JEC's chips with unknown memory storage (Mask/internal, exteral, both?) are a PITA. If the clutch control is leading to that IC then there is little hope for that one.

Would you consider using another one of the port 6 outputs? Idle up control I can see would be the easiest as it seems to be nested in its own subroutine.

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 6:23 am

I wouldn't have thought it would be that difficult? Its all VERY VERY closely tied with the other supercharger port(s), so it MUST be around that area in the code.?
Would you mind highlighting the idle up solenoid bit of code? I don't know what I'm looking for, and it could make an interesting start

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 6:32 am

Well, I guess I should say there is little hope of tracing back the control from the hardware side of things. Your right in that there may still be some control provided by the 6303.

Ill post up the idle routine here in a bit.

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 6:41 am

That would be great - thanks!

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 7:38 am

Here is the idle controller routine.

Code: Select all

IDLE UP SOLENOID ROUTINE D73C
Idle_UP.Routine:
	tim	#$08X007F
	beq	LD747
	oim	#$10X00A8
	jmp	LD7F6
;
LD747:
	tim	#$40X007F
	beq	LD752
	oim	#$10X00A8
	jmp	LD7F6
;
LD752:
	tim	#$10X007F
	beq	LD75D
	oim	#$10X007F
	jmp	LD7F6
;
LD75D:
	tim	#$02X007F
	bne	LD781
	ldx	X01C4
	bne	LD784
	ldd	X013A
	lsrd
	lsrd
	cmpb	XC510
	bcc	LD781
	ldaa	X01C6
	bne	LD78A
	oim	#$01X00A8
	ldx	XC512
	stx	X01C4
	bra	LD78A
;
LD781:
	aim	#$FEX00A8
LD784:
	ldaa	XC511
	staa	X01C6
LD78A:
	tim	#$01X00A8
	bne	LD7F6
	ldd	RPM_MSB
	tsta
	beq	LD796
	ldab	#$FF
LD796:
	stab	X01C7
	tim	#$04X007F
	beq	LD7B3
	tim	#$02X00A8
	beq	LD7B6
	aim	#$FDX00A8
	cmpb	XC514
	bcs	LD7B6
	ldaa	XC515
	staa	X01C8
	bra	LD7B6
;
LD7B3:
	oim	#$02X00A8
LD7B6:
	ldaa	X01C8
	beq	LD7C0
	oim	#$08X00A8
	bra	LD7F6
;
LD7C0:
	aim	#$F7X00A8
	ldaa	X00D8
	ldx	#$C520
	jsr	16x1_Table.GenRoutine
	cmpa	X01C7
	bhi	LD7EB
	tim	#$04X00A8
	beq	LD817
	adda	XC516
	bcc	LD7DC
	ldaa	#$FF
LD7DC:
	cmpa	X01C7
	bhi	LD7EB
	ldaa	X01C9
	bne	LD7F6
	aim	#$FBX00A8
	bra	LD817
;
LD7EB:
	ldaa	XC517
	staa	X01C9
	oim	#$04X00A8
	bra	LD7F6
;
LD7F6:
	tim	#$40X00A8
	bne	LD802
	clra
	staa	X01D8
	oim	#$40X00A8
LD802:
	tim	#$08Port6  '00001000 'Check if Idle.Controller open/closed
	bne	LD812
	ldaa	X01D9
	inca
	bne	LD80F
	ldaa	#$FF
LD80F:
	staa	X01D9
LD812:
	oim	#$08Port6  '00001000 'Set Idle.Controller high (open)
	bra	LD82F
;
LD817:
	tim	#$20X00A8
	bne	LD7F6
	tim	#$08Port6  '00001000 'Check if Idle.Controller open/closed
	beq	LD82C
	ldaa	X01D9
	inca
	bne	LD829
	ldaa	#$FF
LD829:
	staa	X01D9
LD82C:
	aim	#$F7Port6  '11110111 'Unset Idle.Controller low (closed)
LD82F:
	rts

Here a are a few things you can add to your symbol file, not entirely sure but I think the "unknown" ADC is o2 voltage.

;MA09 RAMLIST

symbol 0x012D PrimaryTP
symbol 0x00C3 SecondaryTP

symbol 0x00D4 RPM_MSB
symbol 0x00D6 VSS_SPEED

symbol 0x0130 MAFV10bit_MSB
symbol 0x020D MAFV8bit

symbol 0x0136 CLT_Volt10bit_MSB
symbol 0x0116 CoolantTemp

symbol 0x0134 TPS_10bit_MSB

;?? O2 or EGR
symbol 0x0138 UNKNOWNVolt1_10bit_MSB
symbol 0x022B UNKNOWNVolt1_8bit

;MA09 ROUTINELIST

symbol 0xF94E 16x1_Table.GenRoutine
symbol 0xF988 16x16_Table.GenRoutine
symbol 0xFC6F 64point_16bit_Table.GenRoutine
symbol 0xF957 32x1_Table.GenRoutine

symbol 0xD73C Idle_UP.Routine

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 8:16 am

Thanks! I have updated the .lst file and .sym file to reflect the additions!

That's quite a long routine for the idle. I shall have a look later and try and follow it

Did you spot any thing in the code to do with the super charger pins i identified? that i presume would be the code that needs to be examined to do with the supercharger control!!

This stuff is so exciting haha. Oh finally, what are the chances of dumping the MAF and going MAP? this has been done on the KA series ECUs? that would be my dream haha

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 8:33 am

Ok , pretty sure I found the supercharger routine.

Could you send me an .adr file for this ecu? Romeditor style would be fine, I just want to check a few things out.

Seems the various 'charger control is accomplished at least in part with a handful of 16 point scales.

Map conversion would be easy, well, at least to do it the way I have with ka24e, and ca18det. Ideally I would like to open up some code real estate, thats why I was asking about the idle control. If you were to remove this function you would have a spare port pin and a good amount of code space within a good loop to work with. Potentially a spot to write a VE table /iat correction routine

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 8:35 am

And just in case you are wondering, I dont have anything to do today other than tune a 2nd gen DSM later on in the evening, so theres my free time. lol

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 9:21 am

Add these

;MA09 ROMLIST

byte 0xC8B0 SuperCharger_Control_1 16
byte 0xC8d0 SuperCharger_Control_2 16
byte 0xC8C0 SuperCharger_Control_3 16
byte 0xC8F0 SuperCharger_Control_4 16
byte 0xC8E0 SuperCharger_Control_5 16

byte 0xC897 SuperCharger_Control_Constant1 1
byte 0xC89A SuperCharger_Control_Constant2 1
byte 0xC898 SuperCharger_Control_Constant3 1

;MA09 RAMLIST

symbol 0x0129 RPM_8bit
symbol 0x01AA RPM_LSB_Cropped

symbol 0x0196 SuperCharger_Contr_1_Var
symbol 0x019F SuperCharger_Contr_2_Var
symbol 0x019B SuperCharger_Contr_3_Var
symbol 0x01A9 SuperCharger_Contr_4_Var
symbol 0x01A8 SuperCharger_Contr_5_Var

;MA09 ROUTINELIST

symbol 0xD42D SuperCharger.Routine

It appears that the 16 point table located at 08D0 is what is cutting your supercharger off at 4000 rpm, take a look.

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 9:53 am

Bloody hell!!!!!!! I've been out for a quick drive come back and you my have solved it!!!

Do you have an email/msn to send the .adr file over with?!

I shall add the addresses you found and then get back to you with a longer post. If this works (which i may not know till tomorrow now) you have seriously made my day!

The to-do list for this ECU is getting very quickly smaller, the only other thing I need to find is TTPMIN so I can sort out the 11:1 idle hahahaaaaaaa.

one happy chappy!

GZ@hybridka · Post by **GZ@hybridka** » Fri Oct 12, 2007 10:00 am

I dont need the .adr file actually, just took me a minute to figure out the offset of this rom.

The supercharger subroutine is big, but it looks like it pretty much controls all the outputs for the various solenoids/valves. It seems like it has some boost control functions built in, and different modes of operation (temperature or throttle position related maybe).

It needs to be further analyzed, there may be more than could be tuned out of the control system, like I mentioned before it looks to me like it controls the boost's pressure rising rate and other things as well.

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 10:11 am

Well I can tell you from (re)building the car it that its a fairly complex system. Because I don't know the exact operation of the inside the ECU I don't exactly understand the conditions in which everything operates. But I can tell you that its based on RPM and throttle position. The car only has a MAF sensor, there is no boost meter so that does not play a part. Its not TP load related as changing all the scales and airflow meter made no difference to its operation. Water temp again seems to make no difference.

The ECU does have an airflow cut in it somewhere, but that has not been identified yet as it doesn't appear (so far) to be a problem now the MAF has been changed, but that and TTPMIN are two things that remain.

(honestly I cannot believe how fast this is progressing the help I have been getting is nothing short of stunning) I never even dreamed of this only a few months ago!!!!!

I'm going to put the new know bits of info into an ADR file and see how it comes out. Its all so interesting!!

Fusion Ed · Post by **Fusion Ed** » Fri Oct 12, 2007 10:27 am

Just been trying to add these new constants into nistune, but its says they are invalid instructions. Does it not let you add your own user vars?