EECTuning.org

ollopa

Where in NorCal are you stuck? I'm in Santa Rosa if it's anywhere near where you are. I had one of the very early ELM chips with a UART interface and never got very far with it. The HF scantools, on the other hand, are fairly cheap and I haven't had any complaints with them over the years.

ollopa

calibrationconsole.jpg Got it and added it to my Google drive (see link in first post). I was hoping for more theory of operation and technical bits but it's basically an operator's manual. It does have examples of the DOC cards that calibration engineers would use to navigate a strategy, which I f...

ollopa

I'm interested in who has the physical item, the story of where it came from, and what else they might be in possession of. Also a few pages of the pocket reference are rather blurry and it would be nice to re-photograph them or, better yet, remove the binding and scan them through a ScanSnap or sim...

ollopa

I believe it's over here https://www.merkurencyclopedia.com/EEC-IV/EEC-IV_design.html Specifically https://www.merkurencyclopedia.com/EEC-IV/EEC-schematic.jpg That page also has a very low res B&W scan of a page from the pocket reference. The alignment doesn't quite match the color photos of the sam...

ollopa

Can we configure a wildcard SSL certificate for the site:
https://community.letsencrypt.org/t/acm ... ards/55578

As the current cert is only for eectuning.org, I still get a certificate error if I visit https://www.eectuning.org. A cert for *.eectuning.org would fix it.

ollopa

I've reached out to The Henry Ford / Benson Ford Research Center three times in the past couple of years to discuss gaining access to their calibration console manual. I just got a reply this morning that appears positive but there's a nontrivial fee to retrieve it from storage and make a copy of th...

ollopa

:) Be sure to cruise through the custom IC reference as well. It covers a lot of the same topics but occasionally has a different insight or detail. Both are invaluable!

ollopa

According to the EEC-IV software manual both are signed: 3-2.3.7 SHORT INDEXED ADDRESS MODE The short indexed address mode enables an instruction to access any "A" operand byte or word loca tion within -128 to +127 bytes of a 16-bit base address. The base address is specified by software and is stor...

ollopa

Information wants to be free... That was proven when we were blessed with the Custom IC Pocket Reference Guide. Now after years of sifting through the results of a daily saved search, the complete hardware architecture reference and EEC-IV software manuals emerged and I was able to acquire them. Tot...

ollopa

81C6x Block Diagram.jpg 14-4.4 EXECUTE ENABLE REGISTER (EER) The EER is a memory-mapped 8-bit data holding register that is used to enable and disable the address outputs of the SPC. The SPC address outputs are used to address program instruction locations in RAM. The outputs of the SPC are enabled...

ollopa

Here's some python3 code that calculates ROM_TO value. I tested it against T4M0.bin (CBAZA) (with checksum_end set to 0xFFFD) and as shown for A9M.bin (GUFB). from array import array # ROM BIN file bin_file = 'C:\\EEC\\BINS\\A9M.bin' # Define the checksum range in EEC address space checksum_start = ...

ollopa

You got your answer here https://eectuning.org/forums/viewtopic.php?f=8&t=22975&p=133024&hilit=checksum#p133020 But for anyone else who finds this post and to sum it up succinctly: To calculate a new ROM_TO: 1) Set the current ROM_TO to 0x0000 2) Sum the 16-bit LE words over the checksum range to ge...

ollopa

According to various sources of information... Ford in the 1980's used DEC-20, DEC-VAX, PDP-11, and LSI-11 computer systems for strategy development. They used remote terminals to log into a development environment called VECTOR that ran on DEC-20 and VAX mainframes. VECTOR was developed in-house at...

ollopa

That is the way that I understand decipha's methodology. He also says that at least at 1.0 the NB's are faster responding and more accurate than the WB and dialing in fuel by KAMRF will be easier, faster, and more accurate than eyeballing an AFR meter. I think you'll still use the WBO2 to confirm th...

ollopa

What I'm not totally understanding is how you are using the hegos to tune The open loop WOT fuel... looks like the strategy is to force closed loop at wide open throttle, and then I lose it. I'm reading and retreading your write up and can't figure out what you are doing. Last, I'm curious why you ...

ollopa

What strategy are you using and what is the exact size of the bin file you purchased? Perhaps the bin file has some unexpected padding.

ollopa

Well sorry to necropost but I'm getting into EEC hacking and I find this thread very helpful and interesting. Did ironmanisanemic just give up after all that work? Granted this exercise was a really big ask for someone with no embedded systems experience, but some good progress was being made! Hmm.....

ollopa

So is it accessed via the DAR like other RAM contents?

It sounds like you're saying that normally if you use the RAM's SPC to read, it probably just floats the bus and you get 0xFF's unless the EER was written 0xAA.

Please confirm my ignorance or deny my understanding

ollopa

Does anyone know anything about the EER described in eectch98? There's mention of it in the EEC Memory Control section: The memory system’s efficiency comes from the fact that there are two internal address registers in the ROM, and three internal address registers in the RAM. Plus there's a diagram...

ollopa

I know this is old but a quick search of the help PDF turns up relevant information in section 4.11: 4.11 VEHICLE INFORMATION AND TRANS INFO The vehicle information allows Binary Editor to calculate estimated HP and Torque based off an accelerometer . It also allows Binary Editor to estimate what ge...

ollopa

That's a pretty unusual concept :) I could see that working but if you're going to go to that extreme then you're probably better-off just playing with a MS instead. Of course I never really cared for their CPU choices and their code is a rather nasty mix of ASM and uninspiring C. I still think you'...

ollopa

The way I would have done it is to have an SRAM backed by the KAM power rail for working memory and flash for long-term storage. Whenever power is lost and restored, the contents of flash would be loaded to SRAM so you'd never be stuck with a dead car. You could use DRAM in self-refresh mode when th...

ollopa

This is fascinating. I've wanted to do an EDIS conversion on my T4M0 for some time, but I had long since given up the dream. So I would have to purchase a U4P0 ECU to run A4A1 in my manual GT? I always thought the hardware was identical between CBAZA ECUs and only the loaded strategy was different. ...

ollopa

the problem with the qh2 is that the sram isn't cheap, how many reasonable would shell out $500 for the qh2 when the quarterhorse for half the price does the exact same thing? I think you meant MRAM. QH1 is backed by SRAM and all SRAM is volatile. I wonder why QH couldn't just use flash memory like...

ollopa

My QH battery just died too. Found this thread while searching around and kx250pilot's link is dead. Here's a new link to his thread:
http://forums.corral.net/forums/94-95-t ... ttery.html

ollopa

This code requires some RAM, but I don't know exactly what RAM offsets are used and which ones aren't. I've done NO hacking on EEC firmware but plenty of debugging on various embedded architectures. A common trick to find buffer overflows is to initialize all of RAM to some non-zero value like 0xFF...

ollopa

Well here's what I found... Normalized air charge, referred to as load, is a unitless parameter indicating the ratio of the cylinder air charge to the theoretical air charge of a full cylinder at EEC Standard Temperature and Pressure (standard air charge, SARCHG). The definition of standard air char...

ollopa

Anybody else having problems with BE frequently crashing when stopping and starting datalogging?

ollopa

Here's an update. I modified the CBAZA strat to add the tunepos scalar and payload. I'll attach that in case anyone else wants it. I'm now using BE build 16 with QH 1.6 in Mode 2 and still noticing some bugs. When I click the button to clear tune 8, the tune 5 position blanks out instead of 8. The m...

ollopa

I'd like to see this implemented in CBAZA. Any tips so I could attempt to do this myself? I suppose the main thing I need to know is a safe/unused address to stick this scalar... I noticed some behavior in BE that may be related to this issue. When I write to tune 1, BE says "writing to tune 8," wri...

Search found 43 matches

Re: Project on Reverse Engineering binaries, assembly, coding and learning more about the ECU

Re: I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: Site upgrade and fixes, Saturday July 25th, 2020 12:00AM Central

Re: I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: quick question about indexed ops

I've got the EEC Software Manual and Custom IC Hardware Architecture Reference

Re: Execute Enable Register?

Re: Checksum calculation

Re: Checksum calculation

Re: Back end engineering software from the factory

Re: Calibration vs Tuning J4J1 Why can't I just input known Injector/MAF values and be done?

Re: Calibration vs Tuning J4J1 Why can't I just input known Injector/MAF values and be done?

Re: Trouble opening a existing tune

Re: Who is disassembling 8061 or 8065 code?

Re: Execute Enable Register?

Execute Enable Register?

Re: Datalogging issues with BE 5.117 and CBAZA

Re: Quarterhorse II update desired

Re: Quarterhorse II update desired

Re: Adapting CBAZA (94/95 Mustang) to run 4R70W and EDIS

Re: Quarterhorse II update desired

Re: Possibly a dead quarterhorse battery?

Re: Developing a disassembler. Send me your binaries to test

Re: How do I calculate LOAD?

Re: BE Build 16 seems to be acting up

Re: Possible Tune Selection Bug in QH firmware

Re: Possible Tune Selection Bug in QH firmware