EEC V file conversion

All hardware related, disassembly / programming and code discussions belong here.
jsa
Posts: 259
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: SAD vs Immediate Address Mode

Unread post by jsa »

BOOSTEDEVERYTHING wrote: 2023 Oct 26, 22:39 Sorry, I was doing something wrong.
So was I, so I edited posts above.

viewtopic.php?p=12634#p12634
viewtopic.php?p=12638#p12638
jsa
Posts: 259
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

BOOSTEDEVERYTHING wrote: 2023 Oct 26, 15:20 Here is what i have added so far... I hope they are correct. I need to figure out how to separate by bank in the dir file still. Also need to look at adding cmt entries still. The 2 entries I have commented out produced an error when I added them in the msg file so I commented them out for now. I am sure I made a mistake somehow with the entry.
Yes the DIR additions are generally ok.
Stuff for tuning such as Scalars, Functions, Tables and Payloads want to go in that section.
You will spend most of your time editing this section, so, close to the top is good.

Commands to get SAD to disassemble won't make up a definition file so they can go in bank related sections down lower in the DIR
Sub commands can go in order together.

The R is the reason you are getting an error.
Use 9A and CA without the R, in that order.

Code: Select all

# 20231016 Directive for use with SAD V4.012
#SYM   Rca "FLAGTEMP_BG"                   #UY
#SYM   R9a "CRKFLG"                        :B7

BOOSTEDEVERYTHING wrote: 2023 Oct 26, 22:59 Here is what I have added so far to the eqe3 dir file. I do have an error somewhere I need to find with one of the sym commands and can't seem to find it.
Generally OK.
My observations;
Keep stuff lined up in columns. It will help later if using excel to generate a definition file.
R34 and R36 are temporary scratch registers not Rbases. The TMP prefix in RZASA means temporary. TMP registers only retain data for short periods before being overwritten. They are repeatedly overwritten.
I've added quite a bit of stuff, from the Sub_84827, see if you agree. Check out the dir code below.
Something with a name like TMP_FLAGS may well be a scratch reg, but not certain at this point.
There is a function lookup in this sub. Finding Sub_84827 in the strategies may nail now it's true name.
It appears I've not been observant enough, as I've not spotted ALT_PPM. But times up for today.

Updated EQE3 DIR

Code: Select all

# 20231016 Directive for use with SAD V4.012

RBA d4 280
RBA d6 380 
RBA d8 480 
RBA da 680 
RBA dc 880 
RBA de 980 
RBA e0 a80 
RBA e2 1080 
RBA e4 1180 
RBA e6 1280 
RBA e8 1380 
RBA ea 1480 
RBA ec 1580 
RBA ee 1680


# -----------Scalars Functions Tables Payloads ----------

SYM     8 "IO_INT_MASK"                   # Y #

SYM     C "HSI_MASK"                      # Y #


SYM    12 "HSO_INT_1_MASK"                # W #

SYM    16 "HSO_INT_1_MASK"                # W #

SYM    1A "HSI_EDGE_MODE"                 # Y #

#      34 Temporary scratch
#      36 Temporary scratch

SYM    8C "Flags_8C"                      # Y #
SYM    8C "TFMFLG"                        :B4 #

SYM    9A "Flags_9A"                      # Y #
SYM    9A "CRKFLG"                        :B7 #

SYM    A2 "Flags_A2"
SYM    A2 "BIFLG"                         :B1 #


SYM    A7 "SCP_UP"                        :B5 #

SYM    B9 "Flags_RB9"                     # Y #




SYM    B9 "KAM_ERROR"                     :B4 #

SYM    BC "Flags_BC"                      # Y #
SYM    BC "CCM_ER_ENA"                    :B0 #

SYM    C6 "Flags_C6"                      # Y #
SYM    C6 "FFG_TP"                        :B3 #
SYM    C6 "FFG_PIP?"                      :B4 #
SYM    C6 "FFG_MAF?"                      :B5 #

SYM    D0 "CKINDEX"                       # W #

SYM    D2 "APT"                           # Y #
SYM    D2 "CL_THRTL?"                     :B7 #

#      d4 Rbase 280
#      d6 Rbase 380 
#      d8 Rbase 480 
#      da Rbase 680 
#      dc Rbase 880 
#      de Rbase 980 

#      e0 Rbase a80 
#      e2 Rbase 1080 
#      e4 Rbase 1180 
#      e6 Rbase 1280 
#      e8 Rbase 1380 
#      ea Rbase 1480 
#      ec Rbase 1580 
#      ee Rbase 1680

SYM   180 "TP"                            #UW #
SYM   182 "RATCH"                         #UW #
SYM   184 "TP_REL"			                  #UW #

SYM   19C "iAICE_Ch8"                     # W #
SYM   19E "iADC_Ch8"                      # W #

SYM   1A0 "iADC_Ch9"                      # W #
SYM   1A2 "iADC_ChF"                      # W #
SYM   1A4 "iADC_Ch7"                      # W #
SYM   1A6 "iADC_Ch2"                      # W #
SYM   1A8 "iAICE_Ch2"                     # W #
SYM   1AC "iAICE_Ch4"                     # W #

SYM   1B0 "iAICE_Ch3"                     # W #
SYM   1B4 "iAICE_Ch5"                     # W #

SYM   1C0 "iADC_Ch0"                      # W #
SYM   1C2 "iADC_Ch1"                      # W # 
SYM   1C4 "iAICE_ChF"                     # W #
SYM   1C6 "iAICE_Ch11"                    # W #

SYM   1CC "iMAF"                          # W #
SYM   1CE "iADC_Ch6"                      # W #

SYM   1D2 "iADC_ChC"                      # W #
SYM   1D4 "iADC_Ch5"                      # W #
SYM   1D6 "TP_CNT1"                       #UW # Throttle position counts 1
SYM   1D8 "TP_CNT2"                       #UW # Throttle position counts 2
SYM   1DA "TP_CNT3"                       #UW # Throttle position counts 3
SYM   1DC "TP_CNT4"                       #UW # Throttle position counts 4
SYM   1DE "TP_ENG"                        #UW # Average throttle position

SYM   1EA "LOAD"                          #UW #



SYM   276 "SPI_BIT_TRANSFER_RATE"         # Y #

SYM   312 "SYS_RDY_PRE"                   # Y #

SYM   36E "MORE_EXT_FLAGS"                # Y #

SYM   372 "FLAG_REG53?"                   # Y #

SYM   A4E "P1124STATE"                    #UY #

SYM   A62 "P0121STATE"                    #UY #

SYM   E1C "iADC_ChA"                      # W #

SYM 108DE "RATKAM"                        # W #

SYM 10920 "P1120STATE"                    #UY #
SYM 10922 "P0122STATE"                    #UY #
SYM 10924 "P0123STATE"                    #UY #


SYM 1112E "J1979_01_11"                   # W #
SYM 11226 "iAICE_Ch9"                     # W #

SYM 11334 "AM"                            #UW # 

SYM 11362 "MAF"                           # W #

SYM 11368 "MAF_PTR"                       # W #

SYM 11548 "TP_ENG_LAST"                   #UW # Previous average throttle position
SYM 1154A "P1120_FIL"                     # Y #
SYM 1154B "P0122_FIL"                     # Y #
SYM 1154C "P0123_FIL"                     # Y #
SYM 1154D "P0121_FIL"                     # Y #
SYM 1154E "TPBAR_MT"                      # W #
SYM 11550 "RATCH_REP"                     # W #
SYM 11552 "TP_DIF_CTR"                    #UY #


SYM 120A6 "RATIV"                         #UW #
SYM 120AE "FUEL_APT_LST"                  #UW #

SYM 1636e "ALT_PPM"                       #SW # ??

#SYM 16352 
#SYM 16354
#SYM 16356

SYM 16D8A "ATOD_LIST"                         # Address of analog to digital channel list




FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V 13107 :W V +1 P +5      # Mass Air Flow meter transfer function. CDAN 24-6

FUN 1390C 13927 "uuwFn_1390C_AM>TP" :UW :UW                          # Air Mass > Throttle Position FM??

# ----------- Bank 0 Commands ----------
sca 0485C
sca 04954
sca 04F41
sca 050B9
sca 050FB
sca 0512A
sca 05159
sca 0517C
sca 05240
sca 052C8
sca 052D6
sca 0536A
sca 05403
sca 05523
sca 055db
sca 05628
sca 05698
sca 056F6
sca 05751
sca 057A0
sca 057CC
sca 057F9
sca 05802
sca 05B65

sca 08610

sca 095CB
sca 095D5
sca 095DF
sca 095E9
sca 09651
sca 096B9
sca 096C1
sca 096E6
sca 0970B
sca 0971B
sca 09935
sca 0993C
sca 09947
sca 0994B
sca 0994F
sca 09953
sca 09957
sca 09974

arg 0E8DF 0E8E7 :O 2 UW  :O 2 UY :UW :UY







# ----------- Bank 1 Commands ----------

#WOR 16BE6 16D60

STR 16D8A 16DB7 $Q1 :Y :WN                  # AD_Conversion Structure
STR 16DB8 16DD0 $Q1 :Y :WN                  # AICE Conversion Structure


# ----------- Bank 8 Commands ----------

SYM 82060 "NPTRS"                           #UY
SYM 82061 "NCALS"                           #UY

sca 83359
sca 8335F
sca 83363
sca 845B1
sca 87619
sca 87C93
sca 87CA1
sca 87CAA
sca 87DA6
sca 87E4E
sca 87E9F
sca 87ED5
sca 8D9C7
sca 8E026
sca 8E02C
sca 8E038
sca 8E0A4
sca 8E11C
sca 8E122
sca 8E194
sca 8E19A

# ----------- Bank 9 Commands ----------

sca 94B68


# ------------ Subroutine list----------
Sub 82000 "Sub_82000_Boot"
Sub 83202 "SLU83202_SUYFn"    $ F suyflu 36 :E4 F0 N :WN
Sub 83208 "SLU83208_SSYFn"    $ F ssyflu 36 :E4 F0 N :WN
Sub 8320D "SLU8320D_USYFn"    $ F usyflu 36 :E4 F0 N :WN
Sub 83212 "SLU83212_UUYFn"    $ F uuyflu 36 :E4 F0 N :WN
Sub 83219 "SLU83219_UUYFn"    $ F uuyflu 36

Sub 83265 "SLU83265_SUWFn"    $ F suwflu 36 :E4 F0 N :WN
Sub 8326B "SLU8326B_SSWFn"    $ F sswflu 36 :E4 F0 N :WN
Sub 83270 "SLU83270_USWFn"    $ F uswflu 36 :E4 F0 N :WN
Sub 83275 "SLU83275_UUWFn"    $ F uuwflu 36 :E4 F0 N :WN
Sub 8327C "SLU8327C_UUWFn"    $ F uuwflu 36

Sub 847D4 "Sub847D4_TP_CNT>TP_ENG"                         # Updates TP_ENG from TP_CNT 1 to 4
Updated EQE3 CMT

Code: Select all

# 20231016 Comments for use with SAD V4.012

82406 # = 0x8
8240A # = 0x6
82417 # = 0x8
82424 # = 0x8
82438 # [276]
82431 # = 0x8
82443 # 0x0 != 0

82467 # [11368]
82479 # [11368]
82483 # [11368]

83C22 # [1CC] \s1CC

83C2C # [11362] \s11362

847D5 # [1DE]
847D8 # [11548]
847DE # [1D6]
847E1 # [1D8]
847E8 # [1DA]
847EE # [1DC]
847F7 # [1DE]

8485D # [372]
84864 # [312]
84883 # [16352]
84894 # [16354]
848A5 # [16356]

848BE # [10920]
848C5 # [10922]
848CC # [10924]
848D8 # [11334]
848FF # [180]

8492B # [36E]

84944 # [11552]

8494F # [11552]


BOOSTEDEVERYTHING wrote: 2023 Oct 26, 16:27 I dont have a cmt file for the RZASA bin
You can start your own.
The one I have is full of waffle, only going to confuse matters.
BOOSTEDEVERYTHING wrote: 2023 Oct 26, 18:42 In the CRAI8 docs the TP_CNT strat starts on page 8-2, in the CDAN2 docs it is page 31-90. Also, if I am reading correctly, TTP_CNT is the actual input from the sensor and TP_ENG is the value that the pcm stores, but they are exactly the same value just named differently to separate a recorded value from an input value?
For Sub847D4, I'd say;
CRAI8 Page 8-3
CDAN2 Page 31-91

TP_CNT# is analog to digital read of the sensor.
TP_ENG# is essentially the same value temporarily held by the scratch register.
TP_ENG is the average of the four input reads that the PCM stores.

You can see from those and associated pages, all the info necessary to understand the parameters is provided.
Tracking down Sub_84827 in the strategies should detail it's parameters including the function.

You have a pile on new search terms to use on the LST and strategy docs.

It'd be wise to add a short comment from the strategies to the DIR for each parameter along with the strategy page number.

Looks like you are getting the hang of it.
BOOSTEDEVERYTHING
Posts: 215
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

Wow, Thanks. I will try and add the comments to the dir file. Also I was looking at the page numbers wrong, I was using the page numbers at the tops of the pages, not the bottoms- so you are correct. Thank you for correcting my dir file accordingly and adding to the cmt file. I will study these files first and see how and where I should have been adding my entries. I commented out the tmp and temp entries in the RZASA dir to try and make the lst files for both more similar so I could see the actual register numbers in each file, but I will put them back in now that I am starting to see the code a bit better and see how that goes.
I do have a question about the rbase entries I added, Are they incorrect or are they just temporary? I found the section in the lst file that listed them in a row, maybe I should have seen something with them that noted if they were temp registers or actual rbase numbers?
Thanks again! I will study up on some of the rest of this and I have a large sheet of paper that I've been keeping a list of other similarities on that I will try and add to the dir and cmt files. some are a little more confusing to add so I may need direction on those and will post those up when I get through my list. Thanks
TP_CNT# is analog to digital read of the sensor.
TP_ENG# is essentially the same value temporarily held by the scratch register.
TP_ENG is the average of the four input reads that the PCM stores.
Yes, This is how I understood it. You explained it better than I could.
I think it was Albert Einstein that said " If you can't explain it simply, You don't understand it well enough yourself", so back to reading a little on that as well! LOL
TVRFAN...Thanks you for the comments on hex. I am not beyond anything at all that you guys have to offer me. Any help is appreciated and welcome. Please assume I don't know anything at all, honestly. I can use all of the help I can get! The one thing about hex I am struggling with is keeping an eye out for signed and unsigned numbers and also how to add them up to get the exact address, but I am researching that more and more as this goes. Are all rbase addresses unsigned or is that something I need to look at the address mode of the rbase and that will tell me if it is signed or unsigned? sorry if this question seems like something you have already explained. Trying to get it to "stick".
BOOSTEDEVERYTHING
Posts: 215
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

Try this...
Put this in DIR
CODE: SELECT ALL

SYM 9438B "TC_TPR" # W
Put this in CMT
CODE: SELECT ALL

9438B # [9438B] \s9438B
Run SAD V4.012, LST should now look like;
CODE: SELECT ALL

9438a: a1,00,04,3a ldw R3a,400 TMP4L = 400; # [9438B] TC_TPR
The \s prefix in CMT is telling SAD to print that sym name assigned to 9438B.
SAD 4.07.16B has a bug, so it does not print the TC_TPR from sym 9438B

Sorry, was this meant for the RZASA dir file or my EQE3 dir file?
tvrfan
Posts: 84
Joined: 2023 Oct 22, 22:13
Location: New Zealand
Vehicle Information: Several Kit cars, Ford (Europe), EEC-IV, TVR Vixen, Tasmin (a.k.a Wedge),
Engine - Cologne 2.8 V6 (Europe) catch code 'AA'.

EEC_Disassembler https://github.com/tvrfan/EEC-IV-disassembler

Re: EEC V file conversion

Unread post by tvrfan »

BOOSTEDEVERYTHING wrote: 2023 Oct 27, 08:17 (Edited)
TVRFAN...Thanks you for the comments on hex. I am not beyond anything at all that you guys have to offer me. Any help is appreciated and welcome. Please assume I don't know anything at all, honestly. I can use all of the help I can get! The one thing about hex I am struggling with is keeping an eye out for signed and unsigned numbers and also how to add them up to get the exact address, but I am researching that more and more as this goes. Are all rbase addresses unsigned or is that something I need to look at the address mode of the rbase and that will tell me if it is signed or unsigned? sorry if this question seems like something you have already explained. Trying to get it to "stick".
Good, didn't want to piss anyone off for being too basic...hex does actually take a bit to get your head around if you've not used it before. Can you imagine doing that with binary ? 100100110110011 + 001101001001011 ? That's why computer geeks use hex a lot. At least it's readable (once you get the hang of it).

For EEC addresses, everything is unsigned 16 bits for any calculations and indirect modes, i.e. 0-0xffff. The bank number (0xf0000, 5th digit ) exists separately in 8065 CPU. No banks on 8061 bins. The only exception is the byte mode indexed address offset (as above) which is signed for the calculation, the result is then treated as unsigned address.

All addresses in SAD commands are unsigned, and with multibank bins all addresses must have a bank number, so 5 hex digits. Exceptions to this rule are - 1) Registers (0-0x3ff) have no bank, and, 2) to make SAD compatible with some other tools around, it allows addresses 0x400 - 0x1fff with no bank, but converts them to 0x10400 - 0x11fff (i.e. moves them into Bank 1).

Signed/unsigned VALUES - there's no way to tell without studying at the code, and even then, it's legal to check for negative values by doing something like JNB, B7, Rx <etc> , which would check if the sign bit is set, as well as ,say, JLT (jump if less than) and so on. There are jumps which are for signed and unsigned and so give you a clue. (can give you more if you want, as a guide)

Just to make you go "WTF" (and this is true) the math unit in most CPUs doesn't have a clue whether the numbers it deals with are signed or unsigned, clever design means it doesn't need to. (which makes it quicker) There are only a couple of opcodes which really do need to know (MLT,DIV). Opcodes like CMP (compare) set flag bits in the PSW (processor status word), which provide the ability to handle results/values either way AT THE SAME TIME (signed or not).
jsa
Posts: 259
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

BOOSTEDEVERYTHING wrote: 2023 Oct 27, 12:32
Sorry, was this meant for the RZASA dir file or my EQE3 dir file?
For RZASA.
Use in EQE3 where ever needed with suitable addresses.
jsa
Posts: 259
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

BOOSTEDEVERYTHING wrote: 2023 Oct 27, 08:17 I do have a question about the rbase entries I added, Are they incorrect or are they just temporary? I found the section in the lST file that listed them in a row, maybe I should have seen something with them that noted if they were temp registers or actual rbase numbers?
As I said above, I think R34 and R36 are temporary.
The tmp naming in RZASA is a hint.
Look through the whole EQE3 LST for r34 and r36, how often are they over written with unrelated values?? That is the purpose of scratch registers, to hold a value temporarily.

Rbase normally hold one base address and never change, so those are commanded in DIR. Occasionally a tmp reg might be used as an rbase for a small block of code, use range like the 400 example from rzasa above. Sometimes a register is incremented in a loop and used as an incrementing rbase, SAD could do with a loop command or options to deal with loops in general. Can only set one value per disassembly run for an incementing rbase, so maybe manually with a calculator is easier.

You could name the tmp registers in eqe3 to match rzasa.
BOOSTEDEVERYTHING
Posts: 215
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

You could name the tmp registers in eqe3 to match rzasa.
Top
This is what I was actually working through trying to find in the lst files right now. Was hoping it would help to weed out the temp registers so I could make sure the rest of the rbase entries I added are correct and also see if I could find others that need to be defined.
jsa
Posts: 259
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

Rbase d4 to ee you added are good.
BOOSTEDEVERYTHING
Posts: 215
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

Ok. Thank you. Working on putting in a bunch of stuff I found this weekend. I know I will have some questions when I am done and would like an opinion on what I have added and what I may need to do differently. Also, would like advice on what to put in the cmt file for the entries. Is the best way to post my updates to put it in the code section like I have been or should I zip the cmt and dir files together and post them as an attachment? Thanks again.
Post Reply