|
|
Post by dino2gnt on May 30, 2023 20:54:32 GMT
After fighting with this for several weeks, I figured I might as well throw up a flag and try to get a second set of eyes 
I identified the open loop on/off bit some time ago, via the "fuel system status" subroutine that is referenced both via SCI 14-3B and via OBD2 mode 1 pid 3. (byte 0xF8528 bit 7 in 05293190AC). Using this, i can kick the system into open loop in almost any circumstance, and I've been using it to set Open Loop when the MAP sensor is maxed out (i.e. we are in boost, above the 1bar MAP's range) instead of setting an error on the MAP electrical check. This works fine in _most_ cases, however, any time I'm in in 5th gear and under about 3500 RPM, the system continues to seek on stoich in closed loop (after delta thr enrichment, looks like). The only RPM/VSS (N/V) ratios I see are for rationality checks and bobble spark, and I haven't come across any thing doing direct compares to vss or rpm. I haven't been able to identify any guard rails here that lock out open loop... what am I missing? Any ideas?
|
|
|
|
Post by admin on Jun 6, 2023 10:05:47 GMT
Is this the function we are discussing? {Subroutine}ROM:22E06 ; =============== S U B R O U T I N E =======================================
ROM:22E06
ROM:22E06 ; Fuel system status handler
ROM:22E06
ROM:22E06 HND_FLSYST: ; CODE XREF: __RESET+CDC↑p
ROM:22E06 ldaa #FS_OPEN
ROM:22E08 brclr 7B4h, Z, #80h, loc_22E3A
ROM:22E0E ldaa #FS_OPENDTC
ROM:22E10 brclr DMZ_MFCNFG, #MFOLEN, loc_22E1C ; Misfire open loop enabler
ROM:22E16 brset 624h, Z, #10h, loc_22E3A
ROM:22E1C
ROM:22E1C loc_22E1C: ; CODE XREF: HND_FLSYST+A↑j
ROM:22E1C ldaa #FS_OPENDRIVE
ROM:22E1E brset RAM_THRST1, Z, #40h, loc_22E3A ; Throttle status 1
ROM:22E24 ldab 77Ah, Z
ROM:22E28 bne loc_22E3A
ROM:22E2A ldab RAM_MAP3, Z ; Intake manifold absolute pressure 3
ROM:22E2E cmpb FOC_MAPDEC ; AM inhibit below MAP (TORR)
ROM:22E32 bcs loc_22E3A
ROM:22E34 ldab 7C3h, Z
ROM:22E38 beq loc_22E4E
ROM:22E3A
ROM:22E3A loc_22E3A: ; CODE XREF: HND_FLSYST+2↑j
ROM:22E3A ; HND_FLSYST+10↑j ...
ROM:22E3A staa RAM_FLSST1, Z ; Fuel system status 1
ROM:22E3E brset ORZ_INPUT1, #O2S21EN, loc_22E46 ; Upstream O2 2/1 sensor enabled
ROM:22E44 clra
ROM:22E46
ROM:22E46 loc_22E46: ; CODE XREF: HND_FLSYST+38↑j
ROM:22E46 staa RAM_FLSST2, Z ; Fuel system status 2
ROM:22E4A lbra locret_22EA4
ROM:22E4E ; ---------------------------------------------------------------------------
ROM:22E4E
ROM:22E4E loc_22E4E: ; CODE XREF: HND_FLSYST+32↑j
ROM:22E4E ldaa #FS_CLOSED
ROM:22E50 brset 6B5h, Z, #8, loc_22E5E
ROM:22E56 brclr 75Dh, Z, #8, loc_22E5E
ROM:22E5C bra loc_22E74
ROM:22E5E ; ---------------------------------------------------------------------------
ROM:22E5E
ROM:22E5E loc_22E5E: ; CODE XREF: HND_FLSYST+4A↑j
ROM:22E5E ; HND_FLSYST+50↑j
ROM:22E5E ldaa #FS_OPENDTC
ROM:22E60 brclr ORZ_INPUT1, #O2S21EN, loc_22E74 ; Upstream O2 2/1 sensor enabled
ROM:22E66 brset 6B5h, Z, #4, loc_22E74
ROM:22E6C brclr 75Dh, Z, #4, loc_22E74
ROM:22E72 ldaa #FS_CLOSEDDTC
ROM:22E74
ROM:22E74 loc_22E74: ; CODE XREF: HND_FLSYST+56↑j
ROM:22E74 ; HND_FLSYST+5A↑j ...
ROM:22E74 staa RAM_FLSST1, Z ; Fuel system status 1
ROM:22E78 clra
ROM:22E7A brclr ORZ_INPUT1, #O2S21EN, loc_22EA0 ; Upstream O2 2/1 sensor enabled
ROM:22E80 ldaa #FS_CLOSED
ROM:22E82 brset 6B5h, Z, #4, loc_22E90
ROM:22E88 brclr 75Dh, Z, #4, loc_22E90
ROM:22E8E bra loc_22EA0
ROM:22E90 ; ---------------------------------------------------------------------------
ROM:22E90
ROM:22E90 loc_22E90: ; CODE XREF: HND_FLSYST+7C↑j
ROM:22E90 ; HND_FLSYST+82↑j
ROM:22E90 ldaa #FS_OPENDTC
ROM:22E92 brset 6B5h, Z, #8, loc_22EA0
ROM:22E98 brclr 75Dh, Z, #8, loc_22EA0
ROM:22E9E ldaa #FS_CLOSEDDTC
ROM:22EA0
ROM:22EA0 loc_22EA0: ; CODE XREF: HND_FLSYST+74↑j
ROM:22EA0 ; HND_FLSYST+88↑j ...
ROM:22EA0 staa RAM_FLSST2, Z ; Fuel system status 2
ROM:22EA4
ROM:22EA4 locret_22EA4: ; CODE XREF: HND_FLSYST+44↑j
ROM:22EA4 rts
ROM:22EA4 ; End of function HND_FLSYST I think it intentionally overwrites your kick under certain conditions.
|
|
|
|
Post by dino2gnt on Jun 6, 2023 14:12:01 GMT
Mostly this:
brset RAM_THRST1, Z, #40h, loc_22E3A ; Throttle status 1
0x40 / Bit 7 here is the open loop toggle (as best I can tell). The only thing I can figure is that somehow it's being clobbered by the subroutine that checks throttle status / WOT, but that runs from the main loop I'm resetting it in the IC1 interrupt code, so I can't fathom how it could stay reset...
This sub clears the bit: {CheckIfWOT}{CheckIfWOT}ROM:2D428 CheckIfWOT: ; CODE XREF: tpsCalcs+8p
ROM:2D428 ldaa LearnedTPSfloor
ROM:2D42A adda unk_F53 ; WOT delta throttle 0x85
ROM:2D42E bcs loc_2D434 ; Max 0xD0
ROM:2D430 cmpa #0D0h
ROM:2D432 bcs loc_2D436
ROM:2D434
ROM:2D434 loc_2D434: ; CODE XREF: CheckIfWOT+6j
ROM:2D434 ldaa #0D0h ; Max 0xD0
ROM:2D436
ROM:2D436 loc_2D436: ; CODE XREF: CheckIfWOT+Aj
ROM:2D436 brclr 0C30h, Z, #40h, loc_2D440
ROM:2D43C suba unk_F54 ; WOT hysterysis 0x03
ROM:2D440
ROM:2D440 loc_2D440: ; CODE XREF: CheckIfWOT:loc_2D436j
ROM:2D440 cmpa TPS, Z ; Compare TPS to 0xD0
ROM:2D444 bcc loc_2D44C ; Branch if rA is less than or equal to TPS
ROM:2D446 bset 0C30h, Z, #40h ; Set bit 7 if rA is less than TPS (bit 7 high is open loop)
ROM:2D44A bra loc_2D450
ROM:2D44C ; ---------------------------------------------------------------------------
ROM:2D44C
ROM:2D44C loc_2D44C: ; CODE XREF: CheckIfWOT+1Cj
ROM:2D44C bclr 0C30h, Z, #40h ; Clear bit 7 if TPS is less than rA / 0xD0
ROM:2D44C ; 0xF8C30 bit 7 high/low is open loop on/off
ROM:2D450
ROM:2D450 loc_2D450: ; CODE XREF: CheckIfWOT+22j
ROM:2D450 brclr 0C3Bh, Z, #1, locret_2D4A8
ROM:2D456 brset 0C30h, Z, #40h, loc_2D474
ROM:2D45C ldaa unk_81B, Z
ROM:2D460 beq loc_2D46E
ROM:2D462 brclr 0C3Bh, Z, #10h, loc_2D46E
ROM:2D468 deca
ROM:2D46A staa unk_81B, Z
ROM:2D46E
ROM:2D46E loc_2D46E: ; CODE XREF: CheckIfWOT+38j
ROM:2D46E ; CheckIfWOT+3Aj
ROM:2D46E bclr unk_771, Z, #20h ; This is the set bit for WOT
ROM:2D472 bra locret_2D4A8
ROM:2D474 ; ---------------------------------------------------------------------------
ROM:2D474
ROM:2D474 loc_2D474: ; CODE XREF: CheckIfWOT+2Ej
ROM:2D474 ldaa VEH_SPEED
ROM:2D478 cmpa unk_F55 ; Min vehicle speed for WOT
ROM:2D47C bcs loc_2D49C
ROM:2D47E ldaa unk_81B, Z
ROM:2D482 cmpa unk_F57 ; Maximum limit WOT spark delay timer
ROM:2D486 bcc loc_2D4A4
ROM:2D488 brclr 0C3Bh, Z, #10h, loc_2D494
ROM:2D48E inca
ROM:2D490 staa unk_81B, Z
ROM:2D494
ROM:2D494 loc_2D494: ; CODE XREF: CheckIfWOT+60j
ROM:2D494 cmpa unk_F56 ; Maximum WOT delay 0x0
ROM:2D498 bcs locret_2D4A8
ROM:2D49A bra loc_2D4A4
ROM:2D49C ; ---------------------------------------------------------------------------
ROM:2D49C
ROM:2D49C loc_2D49C: ; CODE XREF: CheckIfWOT+54j
ROM:2D49C ldaa unk_F56 ; Maximum WOT delay 0x0
ROM:2D4A0 staa unk_81B, Z
ROM:2D4A4
ROM:2D4A4 loc_2D4A4: ; CODE XREF: CheckIfWOT+5Ej
ROM:2D4A4 ; CheckIfWOT+72j
ROM:2D4A4 bset unk_771, Z, #20h ; This is the set bit for WOT
ROM:2D4A8
ROM:2D4A8 locret_2D4A8: ; CODE XREF: CheckIfWOT:loc_2D450j
ROM:2D4A8 ; CheckIfWOT+4Aj ...
ROM:2D4A8 rts
ROM:2D4A8 ; End of function CheckIfWOT Next up, guess I rewrite this subroutine, see if keeping the OL bit set while at max map makes the behavior align with my expectations...
|
|
|
|
Post by admin on Jun 7, 2023 6:15:55 GMT
Some nitpicking: your bit numbering is off by one place.
The open loop bit is actually 0x80 (Bit 7):
00000080 ; enum RAM_THRST1_enum, mappedto_134, bitfield
00000080 OPEN: set 10000000b ; XREF: __RESET+95C/s
00000080 ; HND_FLSHTF+6/s ...
This bit is checked countless of times but only changed at 3 places.
It is set once after reset:
ROM:D9E8 bset RAM_THRST1, Z, #OPEN ; Throttle status 1
And set/clear in sub_2D272:
ROM:2D32E bset RAM_THRST1, Z, #OPEN ; Throttle status 1
...
ROM:2D3A6 bclr RAM_THRST1, Z, #OPEN ; Throttle status 1
0x40 (Bit 6) must be related to WOT and open loop.
Try to kick the two leftmost bits together or manipulate sub_2D272 too!
Important enums:
FFFFFFFF RAM_FLSST1: set 528h
00000001 ; enum RAM_FLSST1_enum, mappedto_37, bitfield
00000001 FS_OPEN: set 1 ; XREF: HND_FLSYST/s
00000002 FS_CLOSED: set 10b ; XREF: HND_FLSYST:loc_22E4E/s
00000002 ; HND_FLSYST+7A/s
00000004 FS_OPENDRIVE: set 100b ; XREF: HND_FLSYST:loc_22E1C/s
00000008 FS_OPENDTC: set 1000b ; XREF: HND_FLSYST+8/s
00000008 ; HND_FLSYST:loc_22E5E/s ...
00000010 FS_CLOSEDDTC: set 10000b ; XREF: HND_FLSYST+6C/s
00000010 ; HND_FLSYST+98/s
FFFFFFFF RAM_THRST1: set 0C30h
00000080 ; enum RAM_THRST1_enum, mappedto_134, bitfield
00000080 OPEN: set 10000000b ; XREF: __RESET+95C/s
00000080 ; HND_FLSHTF+6/s ...
|
|
|
|
Post by dino2gnt on Jun 7, 2023 14:47:17 GMT
I feel like someone just told me Santa Claus isn't real. How did you determine that the bitmask is 0x80 and not 0x40? The check @ 0x22E06 to determine fuel system status looks for 0x40:
; 0 The motor is off
; 1 Open loop due to insufficient engine temperature
; 2 Closed loop, using oxygen sensor feedback to determine fuel mix
; 4 Open loop due to engine load OR fuel cut due to deceleration
; 8 Open loop due to system failure
; 16 Closed loop, using at least one oxygen sensor but there is a fault in the feedback system
ROM:22E1C loc_22E1C: ; CODE XREF: SetFuelSystemStatus+Aj
ROM:22E1C ldaa #4
ROM:22E1E brset 0C30h, Z, #40h, loc_22E3A ; 0xF8C30 bit 7 (from 1, because i am a human) is Open Loop on/off
[ ... ]
ROM:22E3A
ROM:22E3A loc_22E3A: ; CODE XREF: SetFuelSystemStatus+2j
ROM:22E3A ; SetFuelSystemStatus+10j ...
ROM:22E3A staa FuelSystemStatus, Z
ROM:22E3E brset HWconfig32F_sensors_0xA4, #40h, loc_22E46 ; This will never branch
[ ... ]
ROM:22E46 loc_22E46: ; CODE XREF: SetFuelSystemStatus+38j
ROM:22E46 staa word_529, Z ; So 0x0
ROM:22E4A lbra locret_22EA4
So that's what I based the assumption on. Do you have a RAM offset map, or are you basing that off an inference somewhere else in the code that is checking against 0x80 somewhere that makes sense? D
|
|
|
|
Post by admin on Jun 7, 2023 15:28:44 GMT
I confused open throttle with open fuel loop...
This line:
ROM:22E1E brset 0C30h, Z, #40h, loc_22E3A ; 0xF8C30 bit 7 (from 1, because i am a human) is Open Loop on/off
checks if WOT, not if open fuel loop.
This bit is toggled in the WOT check sub at ROM:2D428
ROM:2D436 brclr RAM_THRST1, Z, #40h, loc_2D440 ; Throttle status 1
ROM:2D43C suba IAC_WOTHYS ; WOT Hysteresis
ROM:2D440
ROM:2D440 loc_2D440: ; CODE XREF: HND_THRWOT:loc_2D436↑j
ROM:2D440 cmpa RAM_TPSCV1, Z ; Calculated TPS voltage 1
ROM:2D444 bcc loc_2D44C
ROM:2D446 bset RAM_THRST1, Z, #40h ; Throttle status 1
ROM:2D44A bra loc_2D450
ROM:2D44C ; ---------------------------------------------------------------------------
ROM:2D44C
ROM:2D44C loc_2D44C: ; CODE XREF: HND_THRWOT+1C↑j
ROM:2D44C bclr RAM_THRST1, Z, #40h ; Throttle status 1
So basically you force the WOT state when in boost? And that consequently enforces open fuel loop?
I noticed a check for 3500 RPM, when testing MAP sensor performance:
ROM:21EFE ; =============== S U B R O U T I N E =======================================
ROM:21EFE
ROM:21EFE ; Monitor intake manifold absolute pressure
ROM:21EFE
ROM:21EFE MON_MAPVAL: ; CODE XREF: MON_BARO1+14↑p
ROM:21EFE ldaa RAM_TPSDL1, Z ; Delta TPS voltage 1
ROM:21F02 cmpa DIC_MPLTHR ; Throttle threshold - MAP elec
ROM:21F06 bcc locret_21F42
ROM:21F08 lde RAM_ENRPM1, Z ; Engine speed 1
ROM:21F0C cpe #6D60h ; E = 3500 RPM
ROM:21F10 bcc locret_21F42 ; branch if greater or equal
ROM:21F12 cpe #12C0h ; E = 600 RPM
ROM:21F16 bcs loc_21F2A ; branch if lower
ROM:21F18 ldy #DWA_MAPHI ; MAP sensor high
ROM:21F1C ldaa RAM_MAPVLT, Z ; Intake manifold absolute pressure sensor voltage
ROM:21F20 cmpa DIC_MAPHIG ; Out of range high voltage (V)
ROM:21F24 bcc Error
ROM:21F26 jsr sub_24160
ROM:21F2A
ROM:21F2A loc_21F2A: ; CODE XREF: MON_MAPVAL+18↑j
ROM:21F2A ldy #DWA_MAPLO ; MAP sensor low
ROM:21F2E ldaa RAM_MAPVLT, Z ; Intake manifold absolute pressure sensor voltage
ROM:21F32 cmpa DIC_MAPLOW ; Out of range low voltage (V)
ROM:21F36 bcs Error
ROM:21F38 jsr sub_24160
ROM:21F3C bra locret_21F42
ROM:21F3E ; ---------------------------------------------------------------------------
ROM:21F3E
ROM:21F3E Error: ; CODE XREF: MON_MAPVAL+26↑j
ROM:21F3E ; MON_MAPVAL+38↑j
ROM:21F3E jsr DTC_SETFT1 ; Set fault code 1
ROM:21F42
ROM:21F42 locret_21F42: ; CODE XREF: MON_MAPVAL+8↑j
ROM:21F42 ; MON_MAPVAL+12↑j ...
ROM:21F42 rts
ROM:21F42 ; End of function MON_MAPVAL
Above 1 bar it wants to set a fault code and throw a limp-in.
Have you dealt with this?
Santa Claus is _real_ no doubt
|
|
|
|
Post by dino2gnt on Jun 7, 2023 15:40:11 GMT
I confused open throttle with open fuel loop... This line: ROM:22E1E brset 0C30h, Z, #40h, loc_22E3A ; 0xF8C30 bit 7 (from 1, because i am a human) is Open Loop on/off
checks if WOT, not if open fuel loop. This bit is toggled in the WOT check sub at ROM:2D428 I'm not so sure. The final output of the WOT check sub @ 2D428 is:
ROM:2D4A4 loc_2D4A4: ; CODE XREF: CheckIfWOT+5Ej
ROM:2D4A4 ; CheckIfWOT+72j
ROM:2D4A4 bset unk_771, Z, #20h ; This is the check bit for WOT
And in the fuel table lookup subroutine (and Spark, fwiw), it switches between the WOT maps and the PT maps based on 771,Z, not based on C30,Z:
ROM:11FA4 brset 771h, Z, #20h, loc_11FB8 ; If we're @ WOT ...
ROM:11FAA ldx #8F8h ; EGR & PT Fuel / Spark rescale table
ROM:11FAE jsr Prescale_A ; Table lookup X by index A & interpolate; return in A, B, or 0xF8C5D
ROM:11FB2 ldx #0BF6h ; Part throttle base fuel table
ROM:11FB6 bra loc_11FC4
ROM:11FB8 ; ---------------------------------------------------------------------------
ROM:11FB8
ROM:11FB8 loc_11FB8: ; CODE XREF: FuelLookupFromTable+64j
ROM:11FB8 ldx #904h ; WOT Fuel / Spark Rescale table
ROM:11FBC jsr Prescale_A ; Table lookup X by index A & interpolate; return in A, B, or 0xF8C5D
ROM:11FC0 ldx #0F6Ch ; WOT fuel table
|
|
|
|
Post by admin on Jun 7, 2023 15:44:55 GMT
Yeah, I'm not much of a help here, sorry!
|
|
|
|
Post by dino2gnt on Jun 7, 2023 16:06:03 GMT
Yeah, I'm not much of a help here, sorry! It's difficult to do this kind of work in a vacuum  It's much better to have someone to bounce ideas off of, and your inputs are always appreciated.
ROM:2DADE loc_2DADE: ; CODE XREF: ROM:loc_2DADEj
ROM:2DADE brclr 770Fh, Z, #1, loc_2DADE
ROM:2DAE4 ldaa 7711h, Z
ROM:2DAE8 staa 0A84h, Z
ROM:2DAEC ldab 0C4Ch, Z
ROM:2DAF0 cmpb #0FFh
ROM:2DAF2 bcc loc_2DB1A
ROM:2DAF4 cmpb #13h
ROM:2DAF6 bcs loc_2DB1A
ROM:2DAF8 ldab 0A75h, Z
ROM:2DAFC cmpb byte_4AB0
ROM:2DB00 bcc loc_2DB1A
ROM:2DB02 cmpa byte_4AAC
ROM:2DB06 bcc loc_2DB16
ROM:2DB08 cmpa byte_4AAB
ROM:2DB0C bcs loc_2DB16
ROM:2DB0E brclr 6B4h, Z, #20h, loc_2DB14
ROM:2DB14
ROM:2DB14 loc_2DB14: ; CODE XREF: ROM:2DB0Ej
ROM:2DB14 bra loc_2DB1A
ROM:2DB16 ; ---------------------------------------------------------------------------
ROM:2DB16
ROM:2DB16 loc_2DB16: ; CODE XREF: ROM:2DB06j
ROM:2DB16 ; ROM:2DB0Cj
ROM:2DB16 bset 0C30h, Z, #40h
AN unadorned / undecorated dasm of the code currently on the car. No fuel cut, mostly transitions to open loop in boost. I did this last night (sorry this isn't commented, it's a dasm of an in-progress modification): {check_wot}
ROM:2D428 sub_2D428: ; CODE XREF: sub_2D1F6+8p
ROM:2D428
ROM:2D428 ; FUNCTION CHUNK AT ROM:2DD76 SIZE 00000016 BYTES
ROM:2D428
ROM:2D428 ldaa 0Bh, Z
ROM:2D42A adda byte_F53
ROM:2D42E bcs loc_2D434
ROM:2D430 cmpa #0D0h
ROM:2D432 bcs loc_2D436
ROM:2D434
ROM:2D434 loc_2D434: ; CODE XREF: sub_2D428+6j
ROM:2D434 ldaa #0DCh
ROM:2D436
ROM:2D436 loc_2D436: ; CODE XREF: sub_2D428+Aj
ROM:2D436 brclr 0C30h, Z, #40h, loc_2D440
ROM:2D43C suba byte_F54
ROM:2D440
ROM:2D440 loc_2D440: ; CODE XREF: sub_2D428:loc_2D436j
ROM:2D440 cmpa 0A75h, Z
ROM:2D444 bcc loc_2D44C
ROM:2D446 bset 0C30h, Z, #40h
ROM:2D44A bra loc_2D450
ROM:2D44C ; ---------------------------------------------------------------------------
ROM:2D44C
ROM:2D44C loc_2D44C: ; CODE XREF: sub_2D428+1Cj
ROM:2D44C lbra loc_2DD76
ROM:2D450 ; ---------------------------------------------------------------------------
lbra to here --->
ROM:2DD76 ; ---------------------------------------------------------------------------
ROM:2DD76 ; START OF FUNCTION CHUNK FOR sub_2D428
ROM:2DD76
ROM:2DD76 loc_2DD76: ; CODE XREF: sub_2D428:loc_2D44Cj
ROM:2DD76 ldaa 0A84h, Z ; map volts
ROM:2DD7A cmpa byte_4AAC ; 0xFD max volts
ROM:2DD7E bcc loc_2DD84
ROM:2DD80 bclr 0C30h, Z, #40h
ROM:2DD84
ROM:2DD84 loc_2DD84: ; CODE XREF: sub_2D428+956j
ROM:2DD84 bset 0C30h, Z, #40h
ROM:2DD88 lbra loc_2D46E
ROM:2DD88 ; END OF FUNCTION CHUNK FOR sub_2D428
ROM:2DD88 ; ---------------------------------------------------------------------------
<--- and back
ROM:2D46E loc_2D46E: ; CODE XREF: sub_2D428+38j
ROM:2D46E ; sub_2D428+3Aj ...
ROM:2D46E bclr 771h, Z, #20h
ROM:2D472 bra locret_2D4A8
ROM:2D474 ; ---------------------------------------------------------------------------
ROM:2D474
ROM:2D474 loc_2D474: ; CODE XREF: sub_2D428+2Ej
ROM:2D474 ldaa 0A9Ah, Z
ROM:2D478 cmpa byte_F55
ROM:2D47C bcs loc_2D49C
ROM:2D47E ldaa 81Bh, Z
ROM:2D482 cmpa byte_F57
ROM:2D486 bcc loc_2D4A4
ROM:2D488 brclr 0C3Bh, Z, #10h, loc_2D494
ROM:2D48E inca
ROM:2D490 staa 81Bh, Z
ROM:2D494
ROM:2D494 loc_2D494: ; CODE XREF: sub_2D428+60j
ROM:2D494 cmpa byte_F56
ROM:2D498 bcs locret_2D4A8
ROM:2D49A bra loc_2D4A4
ROM:2D49C ; ---------------------------------------------------------------------------
ROM:2D49C
ROM:2D49C loc_2D49C: ; CODE XREF: sub_2D428+54j
ROM:2D49C ldaa byte_F56
ROM:2D4A0 staa 81Bh, Z
ROM:2D4A4
ROM:2D4A4 loc_2D4A4: ; CODE XREF: sub_2D428+5Ej
ROM:2D4A4 ; sub_2D428+72j
ROM:2D4A4 bset 771h, Z, #20h
ROM:2D4A8
ROM:2D4A8 locret_2D4A8: ; CODE XREF: sub_2D428:loc_2D450j
ROM:2D4A8 ; sub_2D428+4Aj ...
ROM:2D4A8 rts
ROM:2D4A8 ; End of function sub_2D428
So, if c30,Z 0x40 is actually the open loop toggle, this should allow it to transition to and from open loop based on MAP, independently of WOT... |
|
|
|
Post by dino2gnt on Jun 7, 2023 17:45:34 GMT
I noticed a check for 3500 RPM, when testing MAP sensor performance: ROM:21EFE ; =============== S U B R O U T I N E =======================================
ROM:21EFE
ROM:21EFE ; Monitor intake manifold absolute pressure
ROM:21EFE
ROM:21EFE MON_MAPVAL: ; CODE XREF: MON_BARO1+14↑p
ROM:21EFE ldaa RAM_TPSDL1, Z ; Delta TPS voltage 1
ROM:21F02 cmpa DIC_MPLTHR ; Throttle threshold - MAP elec
ROM:21F06 bcc locret_21F42
ROM:21F08 lde RAM_ENRPM1, Z ; Engine speed 1
ROM:21F0C cpe #6D60h ; E = 3500 RPM
ROM:21F10 bcc locret_21F42 ; branch if greater or equal
ROM:21F12 cpe #12C0h ; E = 600 RPM
ROM:21F16 bcs loc_21F2A ; branch if lower
ROM:21F18 ldy #DWA_MAPHI ; MAP sensor high
ROM:21F1C ldaa RAM_MAPVLT, Z ; Intake manifold absolute pressure sensor voltage
ROM:21F20 cmpa DIC_MAPHIG ; Out of range high voltage (V)
ROM:21F24 bcc Error
ROM:21F26 jsr sub_24160
ROM:21F2A
ROM:21F2A loc_21F2A: ; CODE XREF: MON_MAPVAL+18↑j
ROM:21F2A ldy #DWA_MAPLO ; MAP sensor low
ROM:21F2E ldaa RAM_MAPVLT, Z ; Intake manifold absolute pressure sensor voltage
ROM:21F32 cmpa DIC_MAPLOW ; Out of range low voltage (V)
ROM:21F36 bcs Error
ROM:21F38 jsr sub_24160
ROM:21F3C bra locret_21F42
ROM:21F3E ; ---------------------------------------------------------------------------
ROM:21F3E
ROM:21F3E Error: ; CODE XREF: MON_MAPVAL+26↑j
ROM:21F3E ; MON_MAPVAL+38↑j
ROM:21F3E jsr DTC_SETFT1 ; Set fault code 1
ROM:21F42
ROM:21F42 locret_21F42: ; CODE XREF: MON_MAPVAL+8↑j
ROM:21F42 ; MON_MAPVAL+12↑j ...
ROM:21F42 rts
ROM:21F42 ; End of function MON_MAPVAL
Above 1 bar it wants to set a fault code and throw a limp-in. Have you dealt with this? Santa Claus is _real_ no doubt Missed this question earlier, Yes, i changed the RPM range of the check to a narrow enough window that it'll almost never be above atmosphere before the RPM climbs out of check range:
ROM:21EFE sub_21EFE: ; CODE XREF: sub_21E08+14p
ROM:21EFE ldaa 0A75h, Z
ROM:21F02 cmpa byte_4AB0
ROM:21F06 bcc locret_21F42
ROM:21F08 lde 0C4Ch, Z
ROM:21F0C cpe #2EE0h ; 1500 RPM
ROM:21F10 bcc locret_21F42
ROM:21F12 cpe #12C0h ; 600 RPM
ROM:21F16 bcs loc_21F2A
ROM:21F18 ldy #41C4h
ROM:21F1C ldaa 0A84h, Z
ROM:21F20 cmpa byte_4AAC
ROM:21F24 nop
ROM:21F26 jsr sub_24160
ROM:21F2A
ROM:21F2A loc_21F2A: ; CODE XREF: sub_21EFE+18j
ROM:21F2A ldy #41BAh
ROM:21F2E ldaa 0A84h, Z
ROM:21F32 cmpa byte_4AAB
ROM:21F36 bcs loc_21F3E
ROM:21F38 jsr sub_24160
ROM:21F3C bra locret_21F42
ROM:21F3E ; ---------------------------------------------------------------------------
ROM:21F3E
ROM:21F3E loc_21F3E: ; CODE XREF: sub_21EFE+38j
ROM:21F3E jsr sub_245CC
ROM:21F42
ROM:21F42 locret_21F42: ; CODE XREF: sub_21EFE+8j
ROM:21F42 ; sub_21EFE+12j ...
ROM:21F42 rts
|
|
|
|
Post by dino2gnt on Jun 8, 2023 0:00:03 GMT
Looking at this with fresh eyes, in the context that C30,Z #40 is a throttle status like you said, and looking at some things that are happening in the same code areas in 05032017AA, I think I am getting somewhere...
This is why it's important that we talk!  |
|
|
|
Post by admin on Jul 7, 2023 9:03:57 GMT
Have you had any luck tracking down the open loop bit and triggering it reliably?
|
|
|
|
Post by dino2gnt on Jul 7, 2023 13:23:14 GMT
Sort of. What tripped me up more than it should have was that OBD2 fuel system status subroutine will happily lie to you, because it can (of course) only show you what it checks and It's not checking for an open loop flag, its checking conditions that should result in open loop operation.
There are constants and checks that should kick us into open loop:
ROM:15B3E loc_15B3E: ; CODE XREF: UpdateAdaptiveMemory+16j
ROM:15B3E ldab MangledMAPvalue, Z
ROM:15B42 cmpb byte_18EE ; Adaptive Memory inhibit above MAP
ROM:15B46 lbhi loc_15C48
ROM:15B4A cmpb byte_18EF ; Adaptive Memory inhibit below MAP
ROM:15B4E lbls loc_15C48
ROM:15B52 ldab byte_18F0 ; Adaptive Memory inhibit above RPM
ROM:15B56 subb RPM_word
ROM:15B5A bcs loc_15B70
ROM:15B5C brclr unk_75F, Z, #2, loc_15B78
ROM:15B62 subb byte_18F1 ; RPM hysterysis for RPMLIM
ROM:15B66 lbcs loc_15C48
The fuel system status subr only checks the lower limit to report status. Looking in 05032017AA the equivalent upper limit is set to 0x80 which, if I can math correctly, should be atmosphere or slightly into positive pressure which makes sense for a factory turbo car. Setting the AM MAP upper limit to 0xFD in a 1bar MAP firmware should have the same result, I would think, but I'm still struggling with the car apparently seeking on stoich when in boost in certain RPM ranges, and I'm not sure why yet. My current strategy is to crank up the fuel to the limit in those areas in the the PT and WOT fuel maps and see if they are having any effect.
If it's over ~3800 RPM, it's fine. If it's in 1st - 3rd gear, it's fine. 4th or 5th, dip into the throttle and make a little boost at speed, and I see it drop down into the 11:1 range (which is fine) but it'll slowly climb back up to ~14.7:1 until i cross some setpoint around 3800RPM. Then it's nice and rich again.
The car has plenty of fuel, mechanically. This is not my first rodeo with turbo NA cars. |
|
|
|
Post by dino2gnt on Jul 28, 2023 19:40:35 GMT
Finally got a chance to drive the car some distance and no, it's the exact same even with the fuel dialed all the way up. it's still acting like it's in closed loop even though the MAP limit for adaptive memory is less than max map voltage. ( byte_18EE above is 0xFD )
I need to spend some time digging through the same code in the Turbo calibration and see what, if anything, is different in how it's handling adaptive memory and fuel trims.
Unless someone has an idea...
|
|
It's much better to have someone to bounce ideas off of, and your inputs are always appreciated.