ECUFlash - Getting close!

[ztan]

Originally Posted by Td-d

ztan - can you test the following two addresses for me for MAF Voltage?

Ram_Mass_Airflow_Sensor_Voltage FFF848FE
Ram_Mass_Airflow_Sensor_Voltage_1 FFF8490E

Both 2 byte parameters (16bit)

Thanks Td-d
Looks like both addresses are the same in A01C and A01G ROMS.
FFF848FE returns 16 bit data, but I can't get math to match MAF data.
FFF8490E returns 0

Short log attached - start, couple of blips and shut down.

[AdrianG]

Originally Posted by Td-d

In post 312.

Thanks for that.

I've been able to add the following from your list and tested successfully:

paramname = accel_pedal_angle
paramid = 0xFFF8922C
isfloat = 1

paramname = IAM
paramid = 0xFFF816F4
isfloat = 1

paramname = throttleplate_angle
paramid = 0xFFF89030
isfloat = 1

paramname = requested_torque
paramid = 0xFFF8B490
isfloat = 1

paramname = knock_advance
paramid = 0xFFF8B0AC
isfloat = 1

paramname = fine_knock_correct
paramid = 0xFFF8B14C
isfloat = 1

paramname = feedback_knock_correction
paramid = 0xFFF8B0B0
isfloat = 1

paramname = engine_load_4byte
paramid = 0xFFF89148
isfloat = 1

I'd really like to learn more about the different data types and how we determine which is which. Everything I am looking for to get started /looks/ like it should be a floating integer... Please correct me if I'm wrong.

[Td-d]

Originally Posted by AdrianG

Thanks for that.

I've been able to add the following from your list and tested successfully:

I'd really like to learn more about the different data types and how we determine which is which. Everything I am looking for to get started /looks/ like it should be a floating integer... Please correct me if I'm wrong.

Most of the direct parameters are float, but you also get word (16bit) and byte (8bit). The only way to verify is to examine the actual code.

[Td-d]

Hmm.. Ztan, can you have a look at the following code - normally, the SSMGet routines fetch a float direct parameter, run it through a makeuint 8 or makeuint16 subroutine, and pop out the SSM parameter - this is the way MAF voltage is pulled in the SH7058 roms.

This one pulls another subroutine, which I have not had the patience to pull apart in understanding Maybe you can have a look?

here is the SSMGet routine:

ROM:000842BC SsmGet_Mass_Airflow_Sensor_Voltage_P18: ; DATA XREF: ROM:00097234o
ROM:000842BC                 movmu.l r14, @-r15      ; Move Multi-register Upper part
ROM:000842BE                 mov     r4, r14         ; Move Data
ROM:000842C0                 mov.l   #sub_12FCC, r2  ; Move Immediate Long Data
ROM:000842C2                 jsr     @R2 ; sub_12FCC ; Jump to Subroutine
ROM:000842C4                 mov     #h'2C, r4 ; ',' ; Move Immediate Byte Data
ROM:000842C6                 extu.w  r0, r6          ; Extend as Unsigned (Word)
ROM:000842C8                 lds     r6, fpul        ; Load to System Register
ROM:000842CA                 float   fpul, fr4       ; Floating-point convert from integer
ROM:000842CC                 mova    flt_84464, r0   ; Move Effective Address
ROM:000842CE                 fmov.s  @r0, fr8        ; Floating-point move single precision
ROM:000842D0                 fmul    fr8, fr4        ; Floating-point multiply
ROM:000842D2                 mov.l   #ConvertTo_uint8, r2 ; Move Immediate Long Data
ROM:000842D4                 fldi0   fr6             ; Floating-point load immediate 0.0
ROM:000842D6                 mova    flt_84468, r0   ; Move Effective Address
ROM:000842D8                 jsr     @R2 ; ConvertTo_uint8 ; Jump to Subroutine
ROM:000842DA                 fmov.s  @r0, fr5        ; Floating-point move single precision
ROM:000842DC                 mov.b   r0, @r14        ; Move Byte Data
ROM:000842DE                 movmu.l @r15+, r14      ; Move Multi-register Upper part
ROM:000842E0                 rts/n                   ; Return from Subroutine with No delay slot

And this is the subroutine it jumps to:

ROM:00012FCC sub_12FCC:                              ; CODE XREF: sub_2A822+18p
ROM:00012FCC                                         ; sub_2AD74+Cp ...
ROM:00012FCC
ROM:00012FCC var_8           = -8
ROM:00012FCC var_7           = -7
ROM:00012FCC
ROM:00012FCC                 sts.l   pr, @-r15       ; Store System Register Long
ROM:00012FCE                 add     #-4, r15        ; Add binary
ROM:00012FD0                 mov.w   r4, @r15        ; Move Word Data
ROM:00012FD2                 movu.b  @(0,r15), r0    ; Move Structure Byte Data as Unsigned
ROM:00012FD6                 tst     r0, r0          ; Test Logical
ROM:00012FD8                 bt      loc_12FE6       ; Branch if True
ROM:00012FDA                 cmp/eq  #1, r0          ; Compare: Equal
ROM:00012FDC                 bt      loc_12FF2       ; Branch if True
ROM:00012FDE                 cmp/eq  #2, r0          ; Compare: Equal
ROM:00012FE0                 bt      loc_12FFE       ; Branch if True
ROM:00012FE2                 bra     loc_1300A       ; Branch
ROM:00012FE4                 nop                     ; No Operation
ROM:00012FE6 ; ---------------------------------------------------------------------------
ROM:00012FE6
ROM:00012FE6 loc_12FE6:                              ; CODE XREF: sub_12FCC+Cj
ROM:00012FE6                 mov.b   @(1,r15), r0    ; Move Structure Byte Data
ROM:00012FE8                 mov.l   #sub_129C4, r1  ; Move Immediate Long Data
ROM:00012FEA                 jsr     @r1 ; sub_129C4 ; Jump to Subroutine
ROM:00012FEC                 mov     r0, r4          ; Move Data
ROM:00012FEE                 bra     loc_1300C       ; Branch
ROM:00012FF0                 mov     r0, r2          ; Move Data
ROM:00012FF2 ; ---------------------------------------------------------------------------
ROM:00012FF2
ROM:00012FF2 loc_12FF2:                              ; CODE XREF: sub_12FCC+10j
ROM:00012FF2                 movu.b  @(1,r15), r0    ; Move Structure Byte Data as Unsigned
ROM:00012FF6                 mov.l   #unk_FFF848FE, r5 ; Move Immediate Long Data
ROM:00012FF8                 shll    r0              ; Shift Logical Left
ROM:00012FFA                 bra     loc_1300C       ; Branch
ROM:00012FFC                 mov.w   @(r0,r5), r2    ; Move Word Data
ROM:00012FFE ; ---------------------------------------------------------------------------
ROM:00012FFE
ROM:00012FFE loc_12FFE:                              ; CODE XREF: sub_12FCC+14j
ROM:00012FFE                 movu.b  @(1,r15), r0    ; Move Structure Byte Data as Unsigned
ROM:00013002                 mov.l   #unk_FFF8490E, r6 ; Move Immediate Long Data
ROM:00013004                 shll    r0              ; Shift Logical Left
ROM:00013006                 bra     loc_1300C       ; Branch
ROM:00013008                 mov.w   @(r0,r6), r2    ; Move Word Data
ROM:0001300A ; ---------------------------------------------------------------------------
ROM:0001300A
ROM:0001300A loc_1300A:                              ; CODE XREF: sub_12FCC+16j
ROM:0001300A                 mov     #0, r2          ; Move Immediate Byte Data
ROM:0001300C
ROM:0001300C loc_1300C:                              ; CODE XREF: sub_12FCC+22j
ROM:0001300C                                         ; sub_12FCC+2Ej ...
ROM:0001300C                 add     #4, r15         ; Add binary
ROM:0001300E                 lds.l   @r15+, pr       ; Load to System Register Long
ROM:00013010                 rtv/n   r2

[ztan]

Originally Posted by Td-d

Hmm.. Ztan, can you have a look at the following code - normally, the SSMGet routines fetch a float direct parameter, run it through a makeuint 8 or makeuint16 subroutine, and pop out the SSM parameter - this is the way MAF voltage is pulled in the SH7058 roms.

This one pulls another subroutine, which I have not had the patience to pull apart in understanding Maybe you can have a look?

Starting from scratch, got the Renesas 72531 manual, this stuff really makes my head hurt.

12FCC looks like a routine where eventually r0 gets tested and if:
0 - goes to 129C4 and loads FFF842A0 into r5
1 - goes to 12FF2 and loads FFF848FE into r5
2 - goes to 12FFE and loads FFF8490E into r6
result from subroutine gets returned in r2

I'll need a lot more time to learn how these things work...

Is there any way to trace RAM addresses from their map locations?

010E00: 000D0560 pointer to MAF scaling table info

0D0560: 00360000 ?2D table with 0x36 (54) values
0D0564: 0011FCD4 pointer to 54 MAF_Volt float values
0D0568: 0011FDAC pointer to 54 MAF_G/S float values

I couldn't find any references to 10E00, which I assume is indirectly referenced.

[Td-d]

MAF Sensor scaling in A00C is referenced at 10E00 - there is a large array / table that is erroneously converted to code by IDA - should be Long Word.

[Td-d]

I'm beginning to wonder whether that's the SSMGet routines location... There's another location in the vicinity of this table: 362BC

[ztan]

Had another look at logging data at FFF848FE.
Looks like smoothed Engine Coolant Temp or possibly oil temp data - plotting ECT from FFF8D24C against -FFF848FE (axes scaled differently):

[ztan]

I've finally found MAF voltage call. Many thanks to td-d, NSFW, and dschultz for their disassembly posts on the RomRaider forum.

Address is the same on A00C and A01G ROMs, is a 16 bit parameter called indirectly, gets scaled, and then indirectly references the MAF scaling table:

paramname = MAF_V
paramid = 0xFFF842AC
databits = 16
scalingrpn = x,0.000076293945,*

It is very indirectly referenced and took a lot of puzzling to find. For those interested in finding out how this ECU works, derivation of this RAM address and indirect referencing headaches posted in the Romraider forums:
http://www.romraider.com/forum/viewt...p=96956#p96956

[vgi]

Originally Posted by Td-d

These are for A00C and A01C:

E_AF_Correction_1_2byteExtExt_E82                      FFF89B48 
E_AF_Correction_1_4byteExt_E81                         FFF8A5D8 
E_AF_Learning_1_2byteExtExt_E83                        FFF89B4C 
E_AF_Learning_1_4byteExt_E48                           FFF8A760 
E_AF_Sensor_1_2byteExtExt_E92                          FFF89B38 
E_AF_Sensor_1_4byteExt_E91                             FFF8932C 
E_Closed_Loop_Fueling_Target_2byteExt_E122             FFF89B4A 
E_Closed_Loop_Fueling_Target_4byteExt_E121             FFF8A6BC 
E_Engine_Load_1byteExtExt_E86                          FFF89B5D 
E_Engine_Load_4ByteExt_E32                             FFF89148 
E_Engine_Speed_Delta_E157                              FFF893FC 
E_Feedback_Knock_Correction_1byteExtExt_E94            FFF89B65 
E_Feedback_Knock_Correction_4byteExt_E39               FFF8B0B0 
E_Final_Fueling_Base_2byteExt_E124                     FFF89B44 
E_Final_Fueling_Base_4byteExt_E123                     FFF8A008 
E_Fine_Learning_Knock_Correction_1byteExtExt_E95       FFF89B68 
E_Fine_Learning_Knock_Correction_4byteExt_E41          FFF8B14C 
E_Fine_Learning_Table_OffsetExt_E58                    FFF8B16B 
E_Fuel_Injector_1_Latency_4byteExt_E50                 FFF8A048 
E_Fuel_Injector_1_Pulse_Width_2byteExtExt_E99          FFF89B40 
E_Fuel_Injector_1_Pulse_Width_4byteExt_E60             FFF887C8 
E_Gear_CalculatedExt_E59                               FFF895DA 
E_IAM_1byteExtExt_E96                                  FFF89B67 
E_IAM_4byteExt_E31                                     FFF816F4 
E_Idle_Speed_Map_SelectionExt_E49                      FFF8B734 
E_Ignition_Base_TimingExt_E53                          FFF8AE74 
E_Knock_Correction_Advance_4byteExt_E43                FFF8B0AC 
E_Knock_Correction_Advance_IAM_onlyExt_E40             FFF8B120 
E_Knock_Correction_Advance_Max_PrimaryExt_E118         FFF8B118 
E_Manifold_Relative_Pressure_4byteExt_E113             FFF88F78 
E_Manifold_Relative_Sea_Level_Pressure_2byteExtExt_E89 FFF89B30 
E_Manifold_Relative_Sea_Level_Pressure_4byteExt_E52    FFF88F74 
E_Primary_Open_Loop_Map_Enrichment_2byteExtExt_E85     FFF89B52 
E_Primary_Open_Loop_Map_Enrichment_4byteExt_E84        FFF8A974 
E_Requested_TorqueExt_E56                              FFF8B490 
E_Target_Throttle_Plate_PositionExt_E57                FFF8B578 
E_Throttle_Plate_Opening_Angle_2byteExtExt_E93         FFF89B32 
E_Throttle_Plate_Opening_Angle_4byteExt_E38            FFF89030 
E_Tipin_ThrottleExt_E54                                FFF89038 

Ram_AFR_Sensor_Heater_Protection_Result                                     FFF88480 
Ram_AFR_Sensor_Heating_Limit_Result                                         FFF88478 
Ram_AF_Correction_3_32bit_ECU                                               FFF8A8EC 
Ram_AF_Learning_3                                                           FFF81644 
Ram_AF_Sensor_1_Current                                                     FFF89328 
Ram_AF_Sensor_1_Resistance                                                  FFF89340 
Ram_AF_Sensor_1_Resistance_0                                                FFF8A624 
Ram_Accelerator_Pedal_Angle                                                 FFF8922C 
Ram_Alternator_Duty                                                         FFF884A4 
Ram_Atmospheric_Pressure_1                                                  FFF89B88 
Ram_Base_Pulse_Width                                                        FFF89738 
Ram_Base_Pulse_Width_times_100_0.84                                         FFF89CB4 
Ram_Battery_Voltage                                                         FFF87C6C 
Ram_CFP_Delta                                                               FFF89048 
Ram_CPC_Valve_Duty_Ratio                                                    FFF89CC4 
Ram_CPC_Valve_Duty_Ratio_0                                                  FFF8BD14 
Ram_Calculated_Base_Pulse_Width_                                            FFF8A044 
Ram_CoolantTemperature                                                      FFF890A4 
Ram_Coolant_Temperature???                                                  FFF87C74 
Ram_ECT???                                                                  FFF89FC6 
Ram_Engine_Speed                                                            FFF89564 
Ram_Fuel_Injector_1_Pulse_Width                                             FFF887D8 
Ram_Fuel_Injector_1_Pulse_Width_4byteExt_E60???                             FFF887F0 
Ram_Fuel_Injector_2_Pulse_Width                                             FFF887DC 
Ram_Fuel_Injector_Pulse_Width?                                              FFF88810 
Ram_Fuel_Injector_Pulse_Width???                                            FFF887C4 
Ram_Fuel_Pressure_MPa                                                       FFF8936C 
Ram_Fuel_Pump_Duty                                                          FFF8B1A0 
Ram_Fuel_Pump_Duty_0                                                        FFF8BD24 
Ram_Gear                                                                    FFF895D9 
Ram_High_Low_Load_0_L_1_H                                                   FFF8A0E4 
Ram_Idle_Switch                                                             FFF8B5B2 
Ram_Idling                                                                  FFF89FBE 
Ram_Ignition_Total_Timing                                                   FFF8ADF8 
Ram_Injector_Pulse_Width???                                                 FFF8884C 
Ram_Intake_Air_Temperature                                                  FFF87C64 
Ram_Intake_OCV_Current_Left                                                 FFF891B4 
Ram_Intake_OCV_Current_Right                                                FFF891A8 
Ram_Intake_OCV_Duty_Left                                                    FFF8C1F8 
Ram_Intake_Temp                                                             FFF890B4 
Ram_Map_Delta?                                                              FFF8A220 
Ram_Mass_Airflow                                                            FFF89114 
Ram_Minimum_CFP_Delta_for_Transient_Retard                                  FFF8B004 
Ram_Port_Temp                                                               FFF8A0F4 
Ram_Roughness_Monitor_Cylinder_1                                            FFF8CEC5 
Ram_Roughness_Monitor_Cylinder_2                                            FFF8CEC6 
Ram_Roughness_Monitor_Cylinder_3                                            FFF8CEC7 
Ram_Roughness_Monitor_Cylinder_4                                            FFF8CEC8 
Ram_SI_Drive_Mode_I3_S1_SSharp2_                                            FFF88999 
Ram_TEST_byte_FFF8B064                                                      FFF8B064 
Ram_Transient_Threshold_Testunk_FFF8923C                                    FFF8923C 
Ram_Vehicle_Speed_0                                                         FFF893C4

Td-d i have a quick Q: ecuflash_brz_beta_1444040.exe version has a sample log file for BRZ ZA1JA00C rom and the addrs are different from the above. i would love to find out why they're different.

type = obd
protocolid = 6 ; ISO15765
mode23txaddrwidth = 4        ; mode23 req format info
mode23txlenwidth = 1        ; mode23 req format info    
mode23rxaddrwidth = 0        ; mode23 req format info
mode23uds = 1            ; lets OBD channels know you are using mode23 UDS
sortpids = 1            ; sort these PIDs by value to potentially make for fewer requests (=faster)
calcsampinterval = 1000        ; timing parameter - leave as is - will make default for release version

; here are some known RAM addresses for ROM ZA1JA00C
; addresses are likely different for other ROMs
; you can comment out ones you don't need, but keep in mind that with
; the block read nature of UDS, reading extra parameters that have
; adjacent addresses comes at very little bandwidth (=sample rate) cost

paramname = LOAD
paramid = 0xFFF8DB6C
isfloat = 1

paramname = COOL_TEMP
paramid = 0xFFF8DB70
isfloat = 1

paramname = STFT
paramid = 0xFFF8DB74
isfloat = 1

paramname = LTFT
paramid = 0xFFF8DB78
isfloat = 1

paramname = MAP
paramid = 0xFFF8DB7C
isfloat = 1

paramname = RPM
paramid = 0xFFF8DB80
isfloat = 1

paramname = SPEED
paramid = 0xFFF8DB84
isfloat = 1

paramname = ADVANCE
paramid = 0xFFF8DB88
isfloat = 1

paramname = IAT
paramid = 0xFFF8DB8C
isfloat = 1

paramname = MAF
paramid = 0xFFF8DB90
isfloat = 1

paramname = TPS
paramid = 0xFFF8DB94
isfloat = 1

paramname = FUEL_PRESS
paramid = 0xFFF8DBA0
isfloat = 1

paramname = LAMBDA
paramid = 0xFFF8DBA4
isfloat = 1

paramname = O2_VOLT
paramid = 0xFFF8DBA8
isfloat = 1

paramname = EVAP
paramid = 0xFFF8DBAC
isfloat = 1

paramname = FUEL_LEVEL
paramid = 0xFFF8DBB0
isfloat = 1

paramname = AMB_PRESS
paramid = 0xFFF8DBB4
isfloat = 1

paramname = O2_CURR
paramid = 0xFFF8DBB8
isfloat = 1

paramname = CAT_TEMP
paramid = 0xFFF8DBBC
isfloat = 1

paramname = ECU_VOLT
paramid = 0xFFF8DBC0
isfloat = 1

paramname = ABS_LOAD
paramid = 0xFFF8DBC4
isfloat = 1

[Td-d]

Originally Posted by vgi

Td-d i have a quick Q: ecuflash_brz_beta_1444040.exe version has a sample log file for BRZ ZA1JA00C rom and the addrs are different from the above. i would love to find out why they're different.

The one's posted with the Ecuflash beta are from the main SSM routine - the one's I posted are from another set of routines that call the bulk of the key parameters and also converts them to either 8 bit or 16 bit parameters (could be the so-called engineering parameters routine that is in all the earlier roms, but I don't think so - that tends to follow a very specific pattern). It's not uncommon to have a parameters copied into multiple addresses by the ecu (and subsequently manipulated).

Keep in mind that I did mention that these are early Alpha parameters - there may well be some that I posted that may not be correct. Only way to check, in the absence of me having a BRZ is for you guys to log and verify

Ztan did some nice work in trawling through the painful routine that indirectly calls various sensor raw data (it's not just MAF voltage, but others such as intake temp voltage, coolant temp voltage, manifold pressure, oil temps etc. Should help pick up some more params.

[ztan]

Originally Posted by vgi

Td-d i have a quick Q: ecuflash_brz_beta_1444040.exe version has a sample log file for BRZ ZA1JA00C rom and the addrs are different from the above. i would love to find out why they're different.

Very good question. I wonder if it is a product of having 2 set of engineers wanting to combine their programming routines into a bastard child and neither wanting to give ground or rewrite their routines. Indirect addressing would allow both sets of engineers access to similar values using, for example, SSM or Toyota mode 21 switches. Would be interesting to see if later Subie ROMs have the same amount of indirect addressing.

I think Colby's params come from the OBD call routines, and the data comes out ordered similarly to an OBD mode 01 list.

When I was chasing the MAF_V parameter, I found somewhere between 6-8 MAF (g/s) parameters, some of which were used for IAT and ECT compensation, some of which just sat as duplicates. There were also a few 8 and 16 bit MAF values that had been reconverted from float values sitting around memory.

[Td-d]

Originally Posted by ztan

I think Colby's params come from the OBD call routines, and the data comes out ordered similarly to an OBD mode 01 list.

Yup - similar to the older roms, but one annoying and significant difference - the older roms had a set of bits after the ECU id that told you which SSM pull routines (and hence parameters) are used in the rom (e.g. 10111111 - P1 is used, P2 is not, etc.) This made the SSM routines the starting point, since it always followed the same order. Not so with this rom

All the SH7055 and SH7058 roms had a so-called engineering parameters routine that converted certain key parameters into 2 byte or 1 byte parameters (this allowed for more parameters to be logged in days gone by, when bandwidth was more constrained with respect to logging, i.e. before fast poll or the mode 23 patch)

[ztan]

Originally Posted by jamesm

i saw the same thing tuning my car for e85. i would log fueling error with the ports turned off and get corrections in one direction, then log with ports only and get different results. getting both 'in spec' independently fixed virtually every drivability problem i had prior to doing this, particularly rough idle, rpms hunting, dipping rpms coming to a stop, stumbling at tip-in, etc. all related to big swings in afr introduced by the disparity in required trim when the switchover happens between injection modes.

you can use the 3 port/di ratio tables to set the ratio. 100% is port only, 0% is di only.

Originally Posted by mad_sb

Yup, this miss-match exists stock and is what prompted me to write the first maf scaling how-to with brzedit.. I just didn't realize this was the cause at the time lol

James and mad-sb:
Can either of you provide a quick how-to on getting port/DI fueling right?
Is it worth re-scaling MAF first, or trying to balance fueling first with the stock MAF scale?