General E931 Eprom Deadtime Address off by 2 bytes?

[redrkt]

Not sure how many people are still playing with the stock code, but I noticed that the deadtime table address when loaded by code is FC E5. The actual deadtime table starts at FCE7 however. I have logged it to verify it is working correctly but i dont understand the offset. I dont believe i've seen any of the other tables offset like this. Below is the code snippet where the table is loaded.

3796 D9DA ;----------------------------
3797 D9DA ; Compute injector deadTime
3798 D9DA ;----------------------------
3799 D9DA CE FC E5 ldx #t_deadtime-2
3800 D9DD 96 D0 ldaa battRaw
3801 D9DF BD EB 4C jsr interp32
3802 D9E2 D7 A6 stab deadTime

Below is the table address:
13491 FCE7 ;******************************************************************
13492 FCE7 ;
13493 FCE7 ;
13494 FCE7 ; Injector deatime as a function of battery voltage
13495 FCE7 ;
13496 FCE7 ; Each unit correspond to 24us ($08 = 192us)
13497 FCE7 ;
13498 FCE7 ;
13499 FCE7 ; Volts: 4.7, 7.0, 9.4, 11.7, 14.1, 16.4, 18.8
13500 FCE7 ;
13501 FCE7 ;******************************************************************
13502 FCE7 t_deadtime
13510 FCE7 #ifdef E931
13511 FCE7 A9 58 30 23 .byte $a9, $58, $30, $23, $1b, $17, $13
13511 FCEB 1B 17 13

Just trying to get a better understanding of how this works.

 

[Jane Hacker]

Don't quote me on this, but it might be because the ADC would never read a sufficiently low value (voltage for the battery) becuase at some point the battery is basically dead and the ECU wouldn't be able to run anyway. So since it will never interpolate a value from the first point(s?) in the table anyway, just point into the table before to save space (not having code to handle the special case saves space too). Pure guess at this point.

 

[redrkt]

Yeah it is strange because in the stock ROM the address actually points to the last 2 bytes of the fuel table. In the rom I use there is blank space before the deadtime table, and when I checked the address it was called from it was 2 bytes off as well so I thought it was an error. Turned out it wasn't . It might have something to do with how 8 bit and 16bit values are handled too. I have not been able to find another example of it in the code either.

 

[bastarddsm]

I wish I could be more help, I have not touched this stuff since 2017. Last time I did I was trying to figure out how to make the maf comp map 2 bytes wide. That and a good way to do flex fuel with maf are the 2 last goals for me. Some day I'll pick it back up.

 

[Jane Hacker]

@redrkt: The more I look at it the more I am convinced my answer might just be correct. Looking at the commented code in the OP we see the values `Volts: 4.7, 7.0, 9.4, 11.7, 14.1, 16.4, 18.8` with the 4.7v minimum being suspiciously close the 5v operating voltage of the processor and logic circuits of the ECU. Given that it is just below that value, and the losses from the voltage regulator etc it seems pretty reasonable that the processor wouldn't be functioning, or at least "in-charge" (limp-home-mode watch-dog might take over??) anywhere below this value. The battRaw is, well, the raw ADC value. So if we plug in the minimum (4.7v) into `interp32`, what does it look like?

8164 EB4C ;******************************************************************
8165 EB4C ;
8166 EB4C ; Table lookup with fractional interpolation
8167 EB4C ; input value = A
8168 EB4C ; input table = X
8169 EB4C ; output value in a and b is (interpolated table) = X(A/32)
8170 EB4C ;
8171 EB4C ;
8172 EB4C ;******************************************************************
;X=0xFCE5 = #t_deadtime-2
;A=battRaw = BATTERY VOLTAGE = (.0733x)v = (18.8 = $FF max, 4.7v = $40 min)
;B=THROWN AWAY
;
8173 EB4C 5F interp32 clrb ;
;
;D=A+0(B) max = 0xFF00, min = 0x4000 (let's focus on min)
;
8174 EB4D 04 lsrd ;
;
;D=0x2000
;
8175 EB4E 04 interp16 lsrd ;
;
;D=0x1000
;
8176 EB4F 04 lsrd ;
;
;D=0x0800
;
8177 EB50 04 lsrd ;
;
;D=0x0400
;
8178 EB51 04 lsrd ; A=A/32, B = 5 LSB of A in upper part
;
;D=0x0200; A=0x02; B=0x00
;
8179 EB52 37 interp1 pshb ; \
;
;stack--
;*stack=B (0x00)
;
8180 EB53 16 tab ; >transfer A to B, only 3 bits left
;
;B=A (0x02)
;
8181 EB54 32 pula ; / At this point, B=integer part of input/32, A=fractional part
;
;A=*stack (0x00)
;stack++
;
8182 EB55 3A abx ; ADD B TO X: B = 0 to 7 (3 bits) (integer table lookup), X=V(0)
;
;X = X (0xFCE5) + B (0x02) = 0xFCE7
;

There we go, `0xFCE7`. Of course the value of 4.7 was found by running the processes backward and seeing that the algorithm only worked to that limit. The choice of that limit is what seems thought out.

@bastarddsm: I might be able to help with that 2-byte map

 

[Jane Hacker]

I dug through the DSM-ECU archives and found this:

From: "o8ford" <jr@...>
Subject: Re: problem with saving deadtime running lean at idle
X-Yahoo-Group-Post: member; u=325979280; y=RsnWVvWUjSaLwK2XiRaMAoiuFweVGo6-LU3b42bSjKdK
X-Yahoo-Profile: o8ford

That value is already maxed out then. You can't get down to 4.7V anyways, =
so it doesn't effect anything; if it was possible to get down to 4.7V, the =
car wouldn't run on that low of voltage.
Don't worry about it.

Looks like that was Wed Jun 24 16:49:59 2009 UTC

 

[redrkt]

I think I see what your saying Jane and it does make sense. Im going to look at that section of code some more. Thanks for the help.
Could you post the link to the DSM Ecu archives? I thought they were lost.
I am interested in the 2 byte map as well. ID like to try making a 2byte fuel map for the Swd code im running. ID like to make it so the fuel map contains the IPw values to use.

 

[Jane Hacker]

The archive I found is the mailing list text only. No files. The links are listed here: https://janehacker.ca/wiki/index.php/DSM_Archive#DSM-ECU_(Yahoo!_Groups)
It isn't exactly a straight-forward archive type, and what you get out is a huge "proprietary Yahoo!" JSON file. Which you can search for text in, given your editor can handle it.

 

[Spleen8urLSX]

Such a shame this a dying art these days, not to thread jack but I was always fascinated in this as an alternative way around the plug n play solutions but even 10 years ago when I started paying any mind to it it was already dying out for the most part. I fear with the way the world is and supply issues that in another year or few this could again be a viable option for some if certain things become unavailable however there’s so few left that know how to utilize it I don’t believe it will be. Glad to see a few of you still keeping it alive.

 

[steve]

Jane has it correct.

If you look at how battery voltage is encoded into the 8 bit value you'll see that you'll never have index values < 2. So while the map does start at 0xFCE7 you trick the interpolation code by passing the address - 2 rather than having two extra bytes in the map you won't use.

Since the ECU pretty much shuts down at < 8v they could have saved two more bytes by skipping 4.7v and 7v.

 

[redrkt]

Thank you for everyone's help in explaining how this works. It is much appreciated.