808 disassembly / TBI support

[BennVenn]

Hi all!

I've spent the last week trying to get AE and Cold start dialed in on this TBI VW motor. I've since given up on OSE12P driving TBI successfully as the AE and manifold wetting code isn't set up for TBI and the cold start when on 4cyl TBI mode (Set by netres) seems to dump 2x requested BPW when running from the cold AFR map, the second it switches from cold to normal AFR, BPW halves and AFR's are spot on.

Using the homemade dyno, I'm happy where the VE tables are at and once I connect the load cell I can get spark tables dialed in. AE seems to enrich every second cycle? It's hard to isolate the issue, half the time it'll go super rich, the other time lean and backfiring. Installing a pulsar tbi memcal and AE is almost perfect, aside from the VE and spark tables being way off.

So my plan is to reverse the AHLU (N13 TBI Manual ROM) to add in basic serial comms to modify tables in real time. TunerPro integration would be a bonus!

Where I'm at:

I have DHC11 and ASHC11 running in dosbox, I can successfully disassemble, modify and reassemble and have the code. I can insert code to write and modify the NVRAM and confirm this in the eprom reader so I'm happy my code is running on there and not crashing the main code.

I've disassembled various 808 compatible ROM's to reverse the serial (8192) memory addresses. I've also found the Bua docs with a lot of this stuff already reversed.

The issue is I can't get a peep out of the MCU's TX port - And I know its working as ose12p is talking with TunerPro.

The code I'm running is:

SerialSetup:

ldS #$01FF ;Set the stack
ldaA #$8C
staA L4001 ;SPI Status
ldaA #$88
staA L4002 ;Port 2 IO
ldaA #$8F
staA L4003 ;Data direction of Port2
ldaA #$90
staA L4004 ;Uart Baud rate to 8192

ldaA #$0C
staA L4007 ;TX and RX enabled

TX:

LDAB L4008 ;Read from uart status reg to clear flags
LDAA #$55
STAA L400A ; TX Data Reg, (SCI) - Send 0x55 ('U') to the UART

LDAA #$00 ;
STAA L4007 ; SET SCI Cntl, (CSR) - Clear the TX flag
LDAA #$08 ;
STAA L4007 ; SET SCI Cntl, (CSR) - Then set it to send off the byte

RET

This is the same code that other bin's use.

Perhaps there is a watchdog that is resetting the MCU (Though that would also prevent my NVRAM code from successfully writing)
Or maybe there are more setup/port config registers I need to initialise first?

Any help would be greatly appreciated!! I know it's now a 30yr old ECU but it'll do everything I need it to do so no sense in retiring it just yet...

Pic's of the dodgy dyno

The dodgy dyno

[BennVenn]

Some progress:
It looks like TXD is shared with the PWM IC (U9) and needs to be tristated or otherwise control released so the MCU isn't fighting it.

ldaA #$BB
ldaB #$46
stD L3FFC

It also looks like there is a CPU watchdog active by default. Keep it happy with this:

ldD #$FF00
stD L400B

Now we're getting Txd activity though realterm is showing NUL when it should be 'U'. Out with the logic analyser to confirm if Realterm just can't connect at this baud, or if its something else... I feel I'm close! Once we can echo a byte we can code up a robust read/write protocol to change map data in real time, hopefully through TunerPro RT

[vlad01]

Have you tried using Mexican port injector manifolds and just sticking to standard multi point injection? There is also a ton of aftermarket injection manifold stuff for these you could use.

[BennVenn]

I have the Mexibug injection setup though the intake doesn't clear the alternator stand so ill need to source the mexi alternator stand too which isn't an option right now. The JB aftermarket stuff is a little pricey with our dollar where it is plus I have a few old morris trucks and a 351C that will be getting TBI so I'd rather have a ready to go drop in solution than custom manifolds, injectors, plumbing etc. It's an interesting coding project too!

The TBI can also run on a fixed fuel pressure meaning returnless plumbing as the injector is always open to the atmosphere, simplifies installation a little. And with the duty of this injector peaking around 30% at full load it seems ideal for a little boost when these tuning bugs are sorted.

It would be great if the experts behind these customs firmwares could share some of the reversed IC's address and functions. Not after any proprietary magic or source code, just the little bits that'll very easily get lost to time if not preserved. A quick search on Aliexpress show all the custom Delco IC's are still available and I received a few last year on an impulse buy to perhaps reinvent the 808.

[BennVenn]

Update:

It's working! Real time tuning is still a Work in progress though I've added enough code to listen for a command (0x55) for 1 second at Key-on before it runs its normal code.

If it detects 0x55 the command set it knows is:

0xFC - Return to the Delco code
0xFD - Read a byte (any address)
0xFE - Write a byte (any address)

The frame structure is:
Read a byte - 0xFD 0xAddHi 0xAddLo 0xZZ 0x55 - ZZ is don't care
Write a byte -0xFE 0xAddHi 0xAddLo 0xData 0x55
Exit -0xFC 0xZZ 0xZZ 0xZZ 0x55

An invalid command will return '!' and the ECU will echo all non 0x55 commands during that 1 second listening period.

I need to go through the code and disable any OEM code that disables the serial port and take control over the Serial Interrupt routine. Then I can modify data real time but for now, it'll be so much more convenient than editing code and burning/flashing via a programmer.

A simple python script should be easy enough to code to detect a change in the Binary when saving in TunerPro and update the required bytes.

[jenko]

I had success with tbi inside 2 su carbies for jag 6cyl application started with jd camira tb bin and set to 6cyl

[BennVenn]

I had success with tbi inside 2 su carbies for jag 6cyl application started with jd camira tb bin and set to 6cyl

WOW! great job keeping it all stealth! are the injector bodies stock from the original throttle body?

Did you find any more tables/scalars in the JD firmware? It still needs a touch more AE though that isn't on the XDF i have here. Might need to go searching...

[jenko]

15 years ago cant really remember although I found I didn't need to change ae but altered timing v map and fiddled with ve vs map and a few other transient scalars it wasnt easy to get rid of the flat spots but I did

[Charlescrown]

I am running 12P on a Mitsubishi Starion with TBI and have no issues at all. I can post my recent bin file if you want to have a look.

[BennVenn]

I am running 12P on a Mitsubishi Starion with TBI and have no issues at all. I can post my recent bin file if you want to have a look.

Yes please!