Nissan ECU Tuning Forum Index Nissan ECU Tuning
Welcome to Nissan ECU Tuning
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Home | Forum

How close are Nissan's registers to std. 63b03?
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Nissan ECU Tuning Forum Index -> 300zx Chip Tuning
View previous topic :: View next topic  
Author Message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Wed Nov 09, 2005 6:35 pm    Post subject: How close are Nissan's registers to std. 63b03? Reply with quote

I've got the 6303 data sheet and I've been looking at my disassemblies with an eye to sorting out the registers.

You guys that have gotten further than me - do you know if all the registers are the same as the datasheet? If not, any hints on which are different?

It looks like all the serial stuff is the same as the DS, the TDR & RDR appear to be the same.

Here's my latest list:

; registers
symbol 0x0001 Port1_DDR
symbol 0x0003 Port1
symbol 0x0008 Timer_control_status1
symbol 0x0009 AD01_notsure
symbol 0x000D AD02_notsure
symbol 0x000F Timer_control_status2
symbol 0x0010 Rate_control
symbol 0x0011 TxRx_control_status1
symbol 0x0012 RDR
symbol 0x0013 TDR
symbol 0x0014 Port5_control
symbol 0x0015 AD04_enginetemp_notsure
symbol 0x0016 Port6_DDR
symbol 0x0017 Port6
symbol 0x001B Timer_control_status3
symbol 0x0020 Port5_DDR
symbol 0x0021 Port6_control



; other external data (found on net, may not be corr.)
symbol 0x1009 AD06
symbol 0x100D AD07
symbol 0x102E AD08
symbol 0x102F AD09
symbol 0x1046 AD10

; Memory locations (some found on net not checked)
symbol 0x0082 5th_gear_check
symbol 0x0055 Knock_status_bit7
symbol 0x140C current_enginetemp
Back to top
View user's profile Send private message
Christian



Joined: 24 Nov 2003
Posts: 20
Karma: 0 (0)


PostPosted: Thu Nov 10, 2005 5:10 pm    Post subject: Reply with quote

>; other external data (found on net, may not be corr.)
>symbol 0x1009 AD06
>symbol 0x100D AD07
>symbol 0x102E AD08
>symbol 0x102F AD09
>symbol 0x1046 AD10

On 8-Bit-Z32-ECUs there are 63140 UPP.
The memory location of the UPP is at 1000h ... 17FFh.
1007 (MSB) & 1008(LSB) : AD0 / AD4 / AD8
1009 & 100A : AD1 / AD5 / AD9
100B & 100C : AD2 / AD6
100D & 100E : AD3 / AD7


>; Memory locations (some found on net not checked)
>symbol 0x0082 5th_gear_check
If MBit (80) at 0082 is set to 1 high octane funktions and tables are used.

>symbol 0x0055 Knock_status_bit7
MBit (80) at 0055 is the high gear indicator (if it is enabled in the BIN)

>symbol 0x140C current_enginetemp
correct. This is the value sendet by the ecu via the consult-port on request.


BTH: Not every function (memory location) used by the ZEMemulator are correct. Be careful.
Back to top
View user's profile Send private message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Thu Nov 10, 2005 7:52 pm    Post subject: Reply with quote

Thanks for the help, Christian.

I think some of those might be different in the Q45 ECU.

This appears to be the subroutine that selects the fuel pointer to start with:

D578 LD578:
D578 : 71 7F D2 aim #$7FX00D2
D57B : 71 4F 8C aim #$4FX008C
D57E : 72 40 8C oim #$40X008C
D581 : 7B 20 8E tim #$20X008E; check bit 6 of 008E
D584 : 27 0F beq LD595; it it's a 0, go to LD595
D586 : 7B 80 5E tim #$80X005E; check bit 8 of 005E
D589 : 27 05 beq LD590 ; if it's a 0, go to LD590
D58B : CE EC 00 ldx #$EC00; load 6C00 fuel table pointer
D58E : 20 12 bra LD5A2
;
D590 LD590:
D590 : CE FD 00 ldx #$FD00;load 7D00 fuel pointer
D593 : 20 0D bra LD5A2
;
D595 LD595:
D595 : 7B 80 5E tim #$80X005E; check bit 8 of 005E
D598 : 27 05 beq LD59F ; if it's a 0, go to LD59F
D59A : CE EE 00 ldx #$EE00; load 6E00 fuel pointer
D59D : 20 03 bra LD5A2
;
D59F LD59F:
D59F : CE ED 00 ldx #$ED00; load 6D00 fuel pointer


Thoughts?


Last edited by rybowen on Thu Nov 10, 2005 11:18 pm; edited 3 times in total
Back to top
View user's profile Send private message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Thu Nov 10, 2005 8:47 pm    Post subject: Reply with quote

Suddenly I realize what you mean - those map definitions aren't right at all!

0x005E is the 5th gear indicator
0x008E is the high octane indicator

So:
EC00 (6C00) = 5th gear no knock fuel
ED00 (6D00) = main knock fuel
EE00 (6E00) = 5th gear knock fuel
FD00 (7D00) = main no-knock fuel


And all this time I thought it was different DOH!
Back to top
View user's profile Send private message
deviousKA



Joined: 14 Jun 2004
Posts: 107
Karma: 0 (0)


PostPosted: Fri Nov 11, 2005 2:31 am    Post subject: Reply with quote

I have found this similar fuel map decision routine in 4cyl 6303 ecu.

If all of the pointers were set to the same location (fuel map), would the code then call only that map? I thought it may be handy to have only a single map location called, for emulator tuning or just generally.

Interesting thread guys, im trying to learn how to better disassemble and understand the 6303 code so it is helpful!
Back to top
View user's profile Send private message AIM Address
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Fri Nov 11, 2005 5:53 am    Post subject: Reply with quote

I'm thinking the same thing.

I don't know the best way to do it, but I'm thinking I'll just change all four pointers to the same map.

OR, I could get really ambitious and re-write the code to ignore those two registers. I think that would be the cleanest way, but I would have to patch the code with lots of nops or something to take up the extra space.

Right now I've done it by eliminating all knock sensing in the ignition map, and by setting 7FC8 to 00.

I don't think it matters how I do it, do you?
Back to top
View user's profile Send private message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Fri Nov 11, 2005 6:18 am    Post subject: Reply with quote

Here's a patched version:


D578 LD578:
D578 : 71 7F D2 aim #$7FX00D2
D57B : 71 4F 8C aim #$4FX008C
D57E : 72 40 8C oim #$40X008C
D581 : CE FD 00 ldx #$ED00; load 7D00 fuel pointer
D584 : 7E D5 A2 jmp D5A2 ; skip the next bit of code

. . . . . .

D5A2 ; subroutine to load RPM/TP scales

That should work without changing more than those six bytes. I'll try it on tomorrow's bin.


Last edited by rybowen on Fri Nov 11, 2005 3:51 pm; edited 3 times in total
Back to top
View user's profile Send private message
cb_drift



Joined: 04 May 2004
Posts: 474
Karma: 0 (0)

Location: New Zealand

PostPosted: Fri Nov 11, 2005 7:03 am    Post subject: Reply with quote

with all the hackery thats being done and can be done - its almost tempting to buy a 300z just for the features you can play with Smile
keep up the good work guys Smile
Back to top
View user's profile Send private message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Fri Nov 11, 2005 7:04 pm    Post subject: Reply with quote

Done - it works great patched. I just left the old code in but added a jmp instruction to skip it. (the addresses are different because I used a different base code than above).

D36D LD36D:
D36D : 71 7F D2 aim #$7FX00D2
D370 : 71 4F 8C aim #$4FX008C
D373 : 72 40 8C oim #$40X008C
D376 : CE FD 00 ldx #$FD00 ; load high-octane fuel map
D379 : 7E D3 97 jmp LD397 ; skip ahead to D397
;
D37C : 80 5E 27 05 db $80, $5E, $27, $05
D380 : CE EC 00 20 db $CE, $EC, $00, $20
D384 : 12 CE FD 00 db $12, $CE, $FD, $00
D388 : 20 0D 7B 80 db $20, $0D, $7B, $80
D38C : 5E 27 05 CE db $5E, $27, $05, $CE
D390 : EE 00 20 03 db $EE, $00, $20, $03
D394 : CE ED 00 db $CE, $ED, $00
;

I did the same for the ignition, but I think there is more to it - the ignition routine looks at more than one flag to determine the map to use.
Back to top
View user's profile Send private message
deviousKA



Joined: 14 Jun 2004
Posts: 107
Karma: 0 (0)


PostPosted: Sat Nov 12, 2005 2:42 am    Post subject: Reply with quote

Nice work rybowen!

I figured that setting those pointers to my liking would essentially accomplish single map. The routines would still be there to load a different map (looking for low octane/knock, 5spd flags?) but would be loading the same address for each condition. I didnt think that this would be a issue, the code is running those routines originally anyways.

But that jump command patch, very slick Cool You should be able to set the ignition table pointers the same to get around any flags, to use the same map, no?

I was also thinking of how to use this to another advantage, single code map switch. Taking over the 5th gear tranny switch and use it as a map switch control, or implement it into some sort of external knock listening circuit would be cool. I was getting into this untill I was doing some reading and realized the 5th gear map routine may need more input, as in the vehicle speed sensor. I havent found any definate information one way or the other, so far.

The 90-92 US stanza, 90-92? Australian TRX, and the australian ford corsair (nissan ka24e)? use a 6303 based ecu with consult SCI. These are the ecus I am messing with as they are 4cyl. Unfortunately I cant do any real testing as I have standalone in my nissan. I might have to retrofit my datsun 510 to mid 90's EFI Smile
Back to top
View user's profile Send private message AIM Address
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Sat Nov 12, 2005 4:22 am    Post subject: Reply with quote

I'm looking into the ignition code right now but it looks more complicated.

The ECU looks at the current engine temp, and if it is above or below certain limits, it uses the knock maps.

There are also two other flags and a second engine temp?? I'm kind of confused.

You're right that it would be simple to just change them all to point at the same map, but still I want to understand what is going on and why the second map is selected.

As for the 5th gear maps, the ECU uses some weird math to calculate when to set the flag. I don't understand it yet.

One of these days I'll look at one of the KA24E bins. I've already learned a lot by looking at a Nissan Patrol (VQ35DE) bin with no knock sensor.
Back to top
View user's profile Send private message
Eric



Joined: 17 Nov 2003
Posts: 266
Karma: +2 (2)

Location: Holland

PostPosted: Sun Nov 13, 2005 6:18 am    Post subject: Reply with quote

there's a simpler way to disable high gear map switching:
Just set address $7FC8 to 00 and it will no longer use these maps.

-Eric
Back to top
View user's profile Send private message Visit poster's website
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Mon Nov 14, 2005 5:48 am    Post subject: Reply with quote

[quote:c602193bdc="Eric"]there's a simpler way to disable high gear map switching:
Just set address $7FC8 to 00 and it will no longer use these maps.

-Eric[/quote:c602193bdc]

That's what I've been doing. Yes, it works, but it doesn't help me understand how the map switching code works. I want to understand the code better...
Back to top
View user's profile Send private message
twin-turboz



Joined: 26 Nov 2003
Posts: 62
Karma: 0 (0)


PostPosted: Thu Dec 01, 2005 6:28 am    Post subject: Reply with quote

This would be great if there is an external way to force the ecu to switch maps, would eliminate the need for multi map Eproms and switchers.
Would be great for someone wanting to run a dry nitrous system or water injection.
It could be set up so that the 5th gear maps are more agressive for water/meth injection or to provide the aditional fuel for a dry nitrous setup.

Even better perhaps would be if there is a way to cause the ecu to trigger the system via say the AIV output at a user selectable point (TP or rpm) and at the same time force the map change within the ecu.


Thoughts?
Back to top
View user's profile Send private message
rybowen



Joined: 08 Sep 2005
Posts: 118
Karma: 0 (0)


PostPosted: Thu Dec 01, 2005 6:32 am    Post subject: Reply with quote

Well, it would not be hard to trigger the AIV or EGR output at a specific RPM or TP level, or really even TPS voltage or all three. You could switch maps the same way - there are some conditionals before the map switching routine that could be re-written to switch maps under different conditions.

I just can't think of a spare input that could be used to switch the maps though. Maybe the EGT sensor input that isn't used on non-CA ECUs? But I don't know if all the hardware is there in every ECU.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Nissan ECU Tuning Forum Index -> 300zx Chip Tuning All times are GMT
Goto page 1, 2, 3  Next
Page 1 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group


Free Forum Free Top Site List
Make this Forum Ad-Free