Idiots guide to disassembly and reading opcode...
Moderator: Matt
Port6 bit 0 goes via PU4424 and controls the supercharger vacuum control solenoid
Port6 bit 1 goes via PU4424 and controls the 'monitor and check lamp - green'
Port6 bit 2 goes via PU4424 and controls the 'monitor and check lamp - red'
Port6 bit 3 goes via PU4424 and controls the 'idle up solenoid'
Port6 bit 4 goes via 2SD1323 and controls the supercharger solenoid stopper valve
Port6 bit 5 goes via PU4424 and controls the supercharger vacuum tank solenoid
Port6 bit 6 goes via PU4424 and controls the supercharger bypass control solenoid
Port6 bit 7 goes to a uPC1074G which appears to be a hardware watchdog timer.
Pin6 from the JECS A19 chip is what controls the supercharger clutch. <<< Unfortunately its not on the same port as the rest of the supercharger controls
Also, at about 4000 RPM is where the supercharger drops OUT, after this point it is assumed that the turbo will be on boost and needs no assistance.
It appears to be based ONLY on throttle position and RPM. It doesn't seem that TP load has ANYTHING to do with it.
Port6 bit 1 goes via PU4424 and controls the 'monitor and check lamp - green'
Port6 bit 2 goes via PU4424 and controls the 'monitor and check lamp - red'
Port6 bit 3 goes via PU4424 and controls the 'idle up solenoid'
Port6 bit 4 goes via 2SD1323 and controls the supercharger solenoid stopper valve
Port6 bit 5 goes via PU4424 and controls the supercharger vacuum tank solenoid
Port6 bit 6 goes via PU4424 and controls the supercharger bypass control solenoid
Port6 bit 7 goes to a uPC1074G which appears to be a hardware watchdog timer.
Pin6 from the JECS A19 chip is what controls the supercharger clutch. <<< Unfortunately its not on the same port as the rest of the supercharger controls
Also, at about 4000 RPM is where the supercharger drops OUT, after this point it is assumed that the turbo will be on boost and needs no assistance.
It appears to be based ONLY on throttle position and RPM. It doesn't seem that TP load has ANYTHING to do with it.
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
Haha, that was quick.
I took a quick glance at it this morning, and from what I gather you mainly need the control of the superchargers clutch.
Those unknown JEC's chips with unknown memory storage (Mask/internal, exteral, both?) are a PITA. If the clutch control is leading to that IC then there is little hope for that one.
Would you consider using another one of the port 6 outputs? Idle up control I can see would be the easiest as it seems to be nested in its own subroutine.
I took a quick glance at it this morning, and from what I gather you mainly need the control of the superchargers clutch.
Those unknown JEC's chips with unknown memory storage (Mask/internal, exteral, both?) are a PITA. If the clutch control is leading to that IC then there is little hope for that one.
Would you consider using another one of the port 6 outputs? Idle up control I can see would be the easiest as it seems to be nested in its own subroutine.
I wouldn't have thought it would be that difficult? Its all VERY VERY closely tied with the other supercharger port(s), so it MUST be around that area in the code.?
Would you mind highlighting the idle up solenoid bit of code? I don't know what I'm looking for, and it could make an interesting start
Would you mind highlighting the idle up solenoid bit of code? I don't know what I'm looking for, and it could make an interesting start
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
Here is the idle controller routine.
Here a are a few things you can add to your symbol file, not entirely sure but I think the "unknown" ADC is o2 voltage.
;MA09 RAMLIST
symbol 0x012D PrimaryTP
symbol 0x00C3 SecondaryTP
symbol 0x00D4 RPM_MSB
symbol 0x00D6 VSS_SPEED
symbol 0x0130 MAFV10bit_MSB
symbol 0x020D MAFV8bit
symbol 0x0136 CLT_Volt10bit_MSB
symbol 0x0116 CoolantTemp
symbol 0x0134 TPS_10bit_MSB
;?? O2 or EGR
symbol 0x0138 UNKNOWNVolt1_10bit_MSB
symbol 0x022B UNKNOWNVolt1_8bit
;MA09 ROUTINELIST
symbol 0xF94E 16x1_Table.GenRoutine
symbol 0xF988 16x16_Table.GenRoutine
symbol 0xFC6F 64point_16bit_Table.GenRoutine
symbol 0xF957 32x1_Table.GenRoutine
symbol 0xD73C Idle_UP.Routine
Code: Select all
IDLE UP SOLENOID ROUTINE D73C
Idle_UP.Routine:
tim #$08X007F
beq LD747
oim #$10X00A8
jmp LD7F6
;
LD747:
tim #$40X007F
beq LD752
oim #$10X00A8
jmp LD7F6
;
LD752:
tim #$10X007F
beq LD75D
oim #$10X007F
jmp LD7F6
;
LD75D:
tim #$02X007F
bne LD781
ldx X01C4
bne LD784
ldd X013A
lsrd
lsrd
cmpb XC510
bcc LD781
ldaa X01C6
bne LD78A
oim #$01X00A8
ldx XC512
stx X01C4
bra LD78A
;
LD781:
aim #$FEX00A8
LD784:
ldaa XC511
staa X01C6
LD78A:
tim #$01X00A8
bne LD7F6
ldd RPM_MSB
tsta
beq LD796
ldab #$FF
LD796:
stab X01C7
tim #$04X007F
beq LD7B3
tim #$02X00A8
beq LD7B6
aim #$FDX00A8
cmpb XC514
bcs LD7B6
ldaa XC515
staa X01C8
bra LD7B6
;
LD7B3:
oim #$02X00A8
LD7B6:
ldaa X01C8
beq LD7C0
oim #$08X00A8
bra LD7F6
;
LD7C0:
aim #$F7X00A8
ldaa X00D8
ldx #$C520
jsr 16x1_Table.GenRoutine
cmpa X01C7
bhi LD7EB
tim #$04X00A8
beq LD817
adda XC516
bcc LD7DC
ldaa #$FF
LD7DC:
cmpa X01C7
bhi LD7EB
ldaa X01C9
bne LD7F6
aim #$FBX00A8
bra LD817
;
LD7EB:
ldaa XC517
staa X01C9
oim #$04X00A8
bra LD7F6
;
LD7F6:
tim #$40X00A8
bne LD802
clra
staa X01D8
oim #$40X00A8
LD802:
tim #$08Port6 '00001000 'Check if Idle.Controller open/closed
bne LD812
ldaa X01D9
inca
bne LD80F
ldaa #$FF
LD80F:
staa X01D9
LD812:
oim #$08Port6 '00001000 'Set Idle.Controller high (open)
bra LD82F
;
LD817:
tim #$20X00A8
bne LD7F6
tim #$08Port6 '00001000 'Check if Idle.Controller open/closed
beq LD82C
ldaa X01D9
inca
bne LD829
ldaa #$FF
LD829:
staa X01D9
LD82C:
aim #$F7Port6 '11110111 'Unset Idle.Controller low (closed)
LD82F:
rts
Here a are a few things you can add to your symbol file, not entirely sure but I think the "unknown" ADC is o2 voltage.
;MA09 RAMLIST
symbol 0x012D PrimaryTP
symbol 0x00C3 SecondaryTP
symbol 0x00D4 RPM_MSB
symbol 0x00D6 VSS_SPEED
symbol 0x0130 MAFV10bit_MSB
symbol 0x020D MAFV8bit
symbol 0x0136 CLT_Volt10bit_MSB
symbol 0x0116 CoolantTemp
symbol 0x0134 TPS_10bit_MSB
;?? O2 or EGR
symbol 0x0138 UNKNOWNVolt1_10bit_MSB
symbol 0x022B UNKNOWNVolt1_8bit
;MA09 ROUTINELIST
symbol 0xF94E 16x1_Table.GenRoutine
symbol 0xF988 16x16_Table.GenRoutine
symbol 0xFC6F 64point_16bit_Table.GenRoutine
symbol 0xF957 32x1_Table.GenRoutine
symbol 0xD73C Idle_UP.Routine
Thanks! I have updated the .lst file and .sym file to reflect the additions!
That's quite a long routine for the idle. I shall have a look later and try and follow it
Did you spot any thing in the code to do with the super charger pins i identified? that i presume would be the code that needs to be examined to do with the supercharger control!!
This stuff is so exciting haha. Oh finally, what are the chances of dumping the MAF and going MAP? this has been done on the KA series ECUs? that would be my dream haha
That's quite a long routine for the idle. I shall have a look later and try and follow it
Did you spot any thing in the code to do with the super charger pins i identified? that i presume would be the code that needs to be examined to do with the supercharger control!!
This stuff is so exciting haha. Oh finally, what are the chances of dumping the MAF and going MAP? this has been done on the KA series ECUs? that would be my dream haha
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
Ok , pretty sure I found the supercharger routine.
Could you send me an .adr file for this ecu? Romeditor style would be fine, I just want to check a few things out.
Seems the various 'charger control is accomplished at least in part with a handful of 16 point scales.
Map conversion would be easy, well, at least to do it the way I have with ka24e, and ca18det. Ideally I would like to open up some code real estate, thats why I was asking about the idle control. If you were to remove this function you would have a spare port pin and a good amount of code space within a good loop to work with. Potentially a spot to write a VE table /iat correction routine
Could you send me an .adr file for this ecu? Romeditor style would be fine, I just want to check a few things out.
Seems the various 'charger control is accomplished at least in part with a handful of 16 point scales.
Map conversion would be easy, well, at least to do it the way I have with ka24e, and ca18det. Ideally I would like to open up some code real estate, thats why I was asking about the idle control. If you were to remove this function you would have a spare port pin and a good amount of code space within a good loop to work with. Potentially a spot to write a VE table /iat correction routine
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
Add these
;MA09 ROMLIST
byte 0xC8B0 SuperCharger_Control_1 16
byte 0xC8d0 SuperCharger_Control_2 16
byte 0xC8C0 SuperCharger_Control_3 16
byte 0xC8F0 SuperCharger_Control_4 16
byte 0xC8E0 SuperCharger_Control_5 16
byte 0xC897 SuperCharger_Control_Constant1 1
byte 0xC89A SuperCharger_Control_Constant2 1
byte 0xC898 SuperCharger_Control_Constant3 1
;MA09 RAMLIST
symbol 0x0129 RPM_8bit
symbol 0x01AA RPM_LSB_Cropped
symbol 0x0196 SuperCharger_Contr_1_Var
symbol 0x019F SuperCharger_Contr_2_Var
symbol 0x019B SuperCharger_Contr_3_Var
symbol 0x01A9 SuperCharger_Contr_4_Var
symbol 0x01A8 SuperCharger_Contr_5_Var
;MA09 ROUTINELIST
symbol 0xD42D SuperCharger.Routine
It appears that the 16 point table located at 08D0 is what is cutting your supercharger off at 4000 rpm, take a look.
;MA09 ROMLIST
byte 0xC8B0 SuperCharger_Control_1 16
byte 0xC8d0 SuperCharger_Control_2 16
byte 0xC8C0 SuperCharger_Control_3 16
byte 0xC8F0 SuperCharger_Control_4 16
byte 0xC8E0 SuperCharger_Control_5 16
byte 0xC897 SuperCharger_Control_Constant1 1
byte 0xC89A SuperCharger_Control_Constant2 1
byte 0xC898 SuperCharger_Control_Constant3 1
;MA09 RAMLIST
symbol 0x0129 RPM_8bit
symbol 0x01AA RPM_LSB_Cropped
symbol 0x0196 SuperCharger_Contr_1_Var
symbol 0x019F SuperCharger_Contr_2_Var
symbol 0x019B SuperCharger_Contr_3_Var
symbol 0x01A9 SuperCharger_Contr_4_Var
symbol 0x01A8 SuperCharger_Contr_5_Var
;MA09 ROUTINELIST
symbol 0xD42D SuperCharger.Routine
It appears that the 16 point table located at 08D0 is what is cutting your supercharger off at 4000 rpm, take a look.
Bloody hell!!!!!!! I've been out for a quick drive come back and you my have solved it!!!
Do you have an email/msn to send the .adr file over with?!
I shall add the addresses you found and then get back to you with a longer post. If this works (which i may not know till tomorrow now) you have seriously made my day!
The to-do list for this ECU is getting very quickly smaller, the only other thing I need to find is TTPMIN so I can sort out the 11:1 idle hahahaaaaaaa.
one happy chappy!
Do you have an email/msn to send the .adr file over with?!
I shall add the addresses you found and then get back to you with a longer post. If this works (which i may not know till tomorrow now) you have seriously made my day!
The to-do list for this ECU is getting very quickly smaller, the only other thing I need to find is TTPMIN so I can sort out the 11:1 idle hahahaaaaaaa.
one happy chappy!
-
- Posts: 112
- Joined: Wed May 03, 2006 5:51 pm
- Location: Id, USA
I dont need the .adr file actually, just took me a minute to figure out the offset of this rom.
The supercharger subroutine is big, but it looks like it pretty much controls all the outputs for the various solenoids/valves. It seems like it has some boost control functions built in, and different modes of operation (temperature or throttle position related maybe).
It needs to be further analyzed, there may be more than could be tuned out of the control system, like I mentioned before it looks to me like it controls the boost's pressure rising rate and other things as well.
The supercharger subroutine is big, but it looks like it pretty much controls all the outputs for the various solenoids/valves. It seems like it has some boost control functions built in, and different modes of operation (temperature or throttle position related maybe).
It needs to be further analyzed, there may be more than could be tuned out of the control system, like I mentioned before it looks to me like it controls the boost's pressure rising rate and other things as well.
Well I can tell you from (re)building the car it that its a fairly complex system. Because I don't know the exact operation of the inside the ECU I don't exactly understand the conditions in which everything operates. But I can tell you that its based on RPM and throttle position. The car only has a MAF sensor, there is no boost meter so that does not play a part. Its not TP load related as changing all the scales and airflow meter made no difference to its operation. Water temp again seems to make no difference.
The ECU does have an airflow cut in it somewhere, but that has not been identified yet as it doesn't appear (so far) to be a problem now the MAF has been changed, but that and TTPMIN are two things that remain.
(honestly I cannot believe how fast this is progressing the help I have been getting is nothing short of stunning) I never even dreamed of this only a few months ago!!!!!
I'm going to put the new know bits of info into an ADR file and see how it comes out. Its all so interesting!!
The ECU does have an airflow cut in it somewhere, but that has not been identified yet as it doesn't appear (so far) to be a problem now the MAF has been changed, but that and TTPMIN are two things that remain.
(honestly I cannot believe how fast this is progressing the help I have been getting is nothing short of stunning) I never even dreamed of this only a few months ago!!!!!
I'm going to put the new know bits of info into an ADR file and see how it comes out. Its all so interesting!!