16159278 $DA2 ADX with commanded AFR

American Delco GM ECUs and PCMs, ALDL, OBD 1.5.
Post Reply
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

16159278 $DA2 ADX with commanded AFR

Post by VX L67 Getrag »

I've never figured out how to look for ADX items & add them from the bin file & wondering if anyone can shed some light on how to add commanded afr to this ADX & add & look for anything else?

All i've done in the past is look for other ADX's with same base code & copy piece's across, but knowing how & where to look for items to add would be great!
Attachments
DA2.adx
(151.6 KiB) Downloaded 578 times
User avatar
delcowizzid
Posts: 5493
Joined: Sat Feb 28, 2009 8:38 pm
Location: Wellington NZ
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by delcowizzid »

gearhead has dissasembly http://www.gearhead-efi.com/Fuel-Inject ... 1331603235 and xdf adx and ads files http://www.gearhead-efi.com/Fuel-Inject ... on-DA2-DA3 and a tuning spreadsheet LOL
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by VX L67 Getrag »

Yeah that is where I got that ads from & converted it to ADX but it doesn't have commanded afr in the adx nor in the DA3 file & I'm not sure how to use the disassembly info?
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by VL400 »

There are a few ways to sort out an ADX, and really depends what you have available.

If you have the vehicle and have nothing to start with in terms of an ADX the first step is to find the command. Use something like the flashtool to send commands until you can find the main engine data table response. Create an ADX as you now know the size of the reply. Define a value for each byte in the response, begin logging and start the car. You will then be able to see things changing, RPM as you rev, coolant and air temp as it warms up, AFR will start to decay towards stoich, IAC steps will stop moving once idle has stabilised, VSS will change as you move the car etc etc etc . Finding flags is a little harder, but note down when say the fans turn on and look for a bit change, A/C the same. Just takes time, a test bench can speed this up massively as you can just tweak things to get an instant response.

Without the ECU the best you can do is disassemble the bin and work through the code. GM used heaps of common modules which makes life easier to use other commented hacks, you look for sections of commented code in your disassembly that relate to the item your defining and work through those parts. For instance AFR, you need to find the main fuel loop code which usually has one of the few fdiv commands to generate the inverse AFR term.
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by VX L67 Getrag »

Thanks for the reply VL400,

Unfortunately I don't have the car or PCM to play with (helping another tuner that gave me a hand with Ford stuff a while ago), I've now told him about this amazing forum so hopefully he can now share when comfortable!

I found with EFI-Live it had a command for LT1 something to do with afr...
$F4,$62,$04,$00,$00,$00,$00,$60,$00,$40,$00,$00,$92,$00,$00,$74

But not sure what it does or how to convert that back as a logged adx item.

I've had a look at similar placements of items in the adx's & tried to add what I think it may be packet offset 0x21 (has 33 in the next box).
I moded the ADX a bit to get rid of farenheit values & moved things around in there order value, but there is a few holes there!

I've also attached the bin (has been supposedly custom tuned to suit cam) & the closest bin I could find to compare (has 70(ish) differences) but the prom id is different so I'm not sure if it is correct?

There is also a few items that aren't identified & nothing even similar in bigger $DA3 xdf, but it's annoying when using tunercats it doesn't have a compare to file function you have to open each section in compare mode & see if there's any differences (any way around this?).
Attachments
1992 $DA2 LT1 Corvette(custom Tuned).bin
(32 KiB) Downloaded 526 times
BAFL vette 5.7LT1 6 speed.BIN
(32 KiB) Downloaded 527 times
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by VL400 »

So you have..
Bin
XDF
ADS
Commented disassembly

Thats a huge start to figuring out an ADX. As you asked for AFR this is one way to try and figure that out. But there are so many ways to find things so whatever works for you.
- We have an XDF with a few Air/Fuel terms can possibly look using them
- We have a mode 4 command that adjusts AFR

In the XDF there is..
"Open Loop %Change to Fuel/Air Ratio Vs. MAP " at address 6D3

Being the bin address we need to add 8000 to get an actual address. Search the disassembly for 86D3. Its referenced in two places, lets pick this one..
A4E0 : PSHB
A4E1 : PSHA
A4E2 : LDAA $0150
A4E5 : LDX #$86D3
A4E8 : JSR $FC14
A4EB : TAB
A4EC : CLRA
A4ED : TSX
A4EE : ADDD $00,X
A4F0 : PULX
A4F1 : XGDX
A4F2 : CLRA
A4F3 : LDAB $867B
A4F6 : FDIV
A4F7 : STX $01B0
A4FA : STX $01AE


So we know MAP is going to be $0150, $FC14 is going to be a 2D lookup routine, then there is some division stuff going on to make the % change before finally saving the modified AFR in two locations. This is pretty common where the ECU will generate two terms, one that is used for ALDL and one for its calcs. The reason is often the ALDL data is non-defaulted during a fault condition ie the ECU uses a substitute value so it can still run with a malfunction, but the ALDL data can show what is really happening.

So we have a possible lead with either $01B0 or $1AE. Will try and cross check this with another method.


Now lets have a look for the ALDL code. From the ADS you can work out the device ID, or from the mode 4 frame you posted..
$F4,$62,$04,$00,$00,$00,$00,$60,$00,$40,$00,$00,$92,$00,$00,$74

You know the device ID is F4 and now also a RAM offset for AFR control which we could use.
- $92 is 146 decimal or 14.6:1 AFR


In the bin you can search for F4, 80 to find the ALDL mode 1 messages. The 80 is from looking at other hacks and knowing that is what the ECU code uses for the fixed messages.

Searching finds this at 0A28...
1.png
1.png (33.29 KiB) Viewed 11012 times
The first occurence is likely going to me mode 1 message 0. From this we know the ALDL RAM buffers are at address $028A, the bytes 02 8A at address 0A16/8A16. It also has the size, $40 or 64 bytes (the ADS specifies 63 payload bytes, not sure why). You would normally start going through the disassembly looking for refrences to 028A but the disassembly txt file has some info that gives a nice shortcut.
It does have an error though, searching for 28A it mentions the buffer is moved to 0x02AD but not during mode 4. Well this is actually done in mode 4 also...
F724 : CMPA #$04
F726 : BNE $F746
F728 : LDD $028B
F72B : STD $02AD
F72E : LDD $028D
F731 : STD $02AF
F734 : LDD $028F
F737 : STD $02B1
F73A : LDD $0291
F73D : STD $02B3
F740 : LDD $0293
F743 : STD $02B5
F746 : LDX $0288


So the mode 4 target AFR gets moved from 293 to 2B5. We know that it was stored in 293 due to counting the frame bytes.

And searching for 02B5 we find...
C6FE : LDAA $02B5
C701 : CLRB
C702 : STD $01AE | M[$01AE] = D


And there is $01AE again so we might be on to something with that one. Checking the Mode 1 Message 0 frame at 0A0F we can look for 01AE. Sadly, after all that it is not there! So either its not included in the frame or we are on the wrong track.

Step two would be to get a data log and see what any undefined bytes do in a data log. Or try logging 01AE to see what it does - can patch the address in the 0A28 message by replacing something else


So thats how I normally find things, use whatever clues you have on hand!
yoda69
Posts: 1215
Joined: Sun Mar 15, 2009 10:20 am
cars: 2004 VYII Acclaim Wagon V6 Auto LPG/Petrol
2004 VYII Berlina sedan V6 Auto
2005 VZ Monaro CV8 manual
Location: Geelong, VIC

Re: 16159278 $DA2 ADX with commanded AFR

Post by yoda69 »

Great description, wish I had something like this when I first started trying to generating xdf's and adx's with the vt stuff.
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: 16159278 $DA2 ADX with commanded AFR

Post by VX L67 Getrag »

Yeah I totally agree Yoda, can't thank you enough for trying to explain & look!

It is still a bit beyond me & had confirmation it is most likely at 1AE & not on output so it would need to be swapped for something else!
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: 16159278 $DA2 ADX with commanded AFR

Post by ejukated »

Great explanation VL400!
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

AZUM Stock file

Post by VX L67 Getrag »

Well Now I'm trying to make sure that the file this guy is starting with hasn't been modified, does anyone have the stock AZUM bin file for a 1992 vette 6 speed manual?
Post Reply