I use OEM Consult serial port, Innovate WBO2s and Mostrich emulator.
My OEM Consult works fine with many other programs.
In Tuner mode, when pressing Consult button, a panel appears telling me the @ 0xEA00 cannot be read, and
Consult connection fails.
What does such error mean !?
If I toggle to stream mode, the Consult connection is successful.
Matt, what are the restrictions of stream mode vs. tuner mode if connected to an OEM Consult !?
Tuner mode: 0xEA00 cannot be read with oem Consult !?
Moderator: Matt
-
RomChip200
- Posts: 426
- Joined: Mon May 11, 2009 7:58 pm
- Location: FRANCE
-
RomChip200
- Posts: 426
- Joined: Mon May 11, 2009 7:58 pm
- Location: FRANCE
I use a 47P10 heavily modified.
Consult write routine is added and code is instrumented with my own routines located @0xE000 and E200 to perform some embedded logs or tests (max TP, dasboard light up when switching to knock maps, ...)
I just checked in my dissassembled code:
0xEA00 that is the registers list is left untouched.
But I will check with a stock 47P10 tonight.
Matt, could you clarify where TP is extracted from ?
In the post above, you associate Moates and stream mode and in configuration panel, there's an option "Inject TP in Consult stream".
Could you also clarify the purpose/impact of these options?:
"Filtered table view"
"Address file hardware trace region"
And the last but not least, why are you using the 0x8000-0xFFFF portion in Moates and not 0x0000-0x7FFF (my moates emulates a 27C040 EPROM i.e. a 0x80000 image). Not using 0x0000-0x7FFF by default makes the things painful to handle.
Consult write routine is added and code is instrumented with my own routines located @0xE000 and E200 to perform some embedded logs or tests (max TP, dasboard light up when switching to knock maps, ...)
I just checked in my dissassembled code:
0xEA00 that is the registers list is left untouched.
But I will check with a stock 47P10 tonight.
Matt, could you clarify where TP is extracted from ?
In the post above, you associate Moates and stream mode and in configuration panel, there's an option "Inject TP in Consult stream".
Could you also clarify the purpose/impact of these options?:
"Filtered table view"
"Address file hardware trace region"
And the last but not least, why are you using the 0x8000-0xFFFF portion in Moates and not 0x0000-0x7FFF (my moates emulates a 27C040 EPROM i.e. a 0x80000 image). Not using 0x0000-0x7FFF by default makes the things painful to handle.
[b] Custom tunes S13/Z32/GTIR. First Z32 flex fuel (E85/unleaded) [/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
ECU physical address offset is 0x8000
Consult offset + 0x6A00 = 0xEA00 is your consult table
Nistune will use the C9 EA 00 cconsult command to read this address. If it returns FE (error) then it will fail and cause the error. The consult log will show the speciifics of why it doesnt work with your modified ROM image. It may be a fault of firmware changes to your code. I have confirmed this to work normally in factory Z32 ROM code
TP is added to the last 2 bytes of the consult table. Good for all ECUs where it is empty except the ER34 where that is a different (unknown parameter)
We inject the TP address into these bytes in the consult table and then you upload it to the emulator. When this option is ticked we then monitor this register and display it as 'TP'
TPREF in the address file can override the default address used inside Nistune
Filtered table view works to reduce the timing values by IDLE_TIMING_MAP_OFFSET if specified in the address file. Used on some ECUs like S13 CA18 for example which has a different to actual used timing values in the raw maps
Similar to 'filtered view' on the timing tables which offsets by TIMING_MAP_OFFSET if specified in the address file
When the filtered views are used you can only increment/decrement. Raw view allows direct edit and copy/paste to the cells
Address file hardware trace region is a special thing for hardware tracing. If ticked, it will perform hardware maptracing visible in the 'hex editor' window inside Nistune
Parameters used from the address file are MAPTRACE_START and MAPTRACE_END. These are memory addresses to trace between
EMULATOR_OFFSET is specified internally to be 0x0000 for 64KB ROM images and 0x8000 for 32KB ROM images. This is correct as its the physical address space in the emulator if the emulator is 64KB and used in a 27C512 socket for instance
You have only used it with the 8 bit ECU from what I can see. If you are trying this with 16 bit daghterboards for example then the offsets become very important to get the right address space otherwise things wont work. Some daughterboards have hardware 'bugs' where the emulator must be 0x0000 because they hardwire top address lines in the ECU instead of using the addresses from the chip
you can add that paramter to an address file to override defaults and specify EMULATOR_OFFSET=&H0000 for example to change it
Consult offset + 0x6A00 = 0xEA00 is your consult table
Nistune will use the C9 EA 00 cconsult command to read this address. If it returns FE (error) then it will fail and cause the error. The consult log will show the speciifics of why it doesnt work with your modified ROM image. It may be a fault of firmware changes to your code. I have confirmed this to work normally in factory Z32 ROM code
TP is added to the last 2 bytes of the consult table. Good for all ECUs where it is empty except the ER34 where that is a different (unknown parameter)
We inject the TP address into these bytes in the consult table and then you upload it to the emulator. When this option is ticked we then monitor this register and display it as 'TP'
TPREF in the address file can override the default address used inside Nistune
Filtered table view works to reduce the timing values by IDLE_TIMING_MAP_OFFSET if specified in the address file. Used on some ECUs like S13 CA18 for example which has a different to actual used timing values in the raw maps
Similar to 'filtered view' on the timing tables which offsets by TIMING_MAP_OFFSET if specified in the address file
When the filtered views are used you can only increment/decrement. Raw view allows direct edit and copy/paste to the cells
Address file hardware trace region is a special thing for hardware tracing. If ticked, it will perform hardware maptracing visible in the 'hex editor' window inside Nistune
Parameters used from the address file are MAPTRACE_START and MAPTRACE_END. These are memory addresses to trace between
EMULATOR_OFFSET is specified internally to be 0x0000 for 64KB ROM images and 0x8000 for 32KB ROM images. This is correct as its the physical address space in the emulator if the emulator is 64KB and used in a 27C512 socket for instance
You have only used it with the 8 bit ECU from what I can see. If you are trying this with 16 bit daghterboards for example then the offsets become very important to get the right address space otherwise things wont work. Some daughterboards have hardware 'bugs' where the emulator must be 0x0000 because they hardwire top address lines in the ECU instead of using the addresses from the chip
you can add that paramter to an address file to override defaults and specify EMULATOR_OFFSET=&H0000 for example to change it
I had a similar issue with a binary where I customized some code (nothing in or near the consult routines though).
After the ENT-file generation and loading it up into the board, the Nistune software was unable to connect.
My conzult software connected fine though and diagnostics could be made.
could there be something wrong in the ENT-file generation part of the software ?
After the ENT-file generation and loading it up into the board, the Nistune software was unable to connect.
My conzult software connected fine though and diagnostics could be made.
could there be something wrong in the ENT-file generation part of the software ?
-
RomChip200
- Posts: 426
- Joined: Mon May 11, 2009 7:58 pm
- Location: FRANCE
1)
Matt,
I found out the issue, this is due to the 0xCA command that fails.
Have a look to the extract of log attached.
I (and Eric probably also) included a Consult write command provided originally by Pascal. This command is based on 0xCA and probably differs from your write protocol. Could you explain it ? (I just don't remember the write protocol of the 0xCA command provided by Pascal).
I patched my rom quickly with 0xCB not to interfere with yours and it works fine now
2)
Matt,
As I corrected the 1), I can now access to some new registers in Consult Tuner mode :
_Knock sense
_Fuel knock flag
But how to use them or to take them into account ? I cannot display the corresponding gauges and they don't appear in log files neither. Is there a link with the knock warning panel ?
Could you clarify ? Because these 2 knock indicators would be very helpful for me.
Does it require to map the knock registers in the Consult table (as mentioned, you added 140C and 140D at the end for TP).
FYI, I use the following to detect knock in my modified rom:
RAM1:005A flags10: rmb 1 ; ...
RAM1:005A ; Bit 2: 1=normal map, 0=knock map
RAM1:0082 flags8: rmb 1 ; ...
RAM1:0082 ; Bit 1: 1=inside knock learn region
RAM1:0082 ; Bit 7: 0=knoc
tim %100,flags10 knock map in use ?
beq knock_map_entered
tim %10000000,flags8 knock detection ?
beq knock_detected
RAM2:14BD knock_count: rmb 1
I forgot how this last one behaves exactly.
3)
Matt, Eric,
I take the benefit of this post to describe a trouble that occured with my 370cc to 740cc swap. I need your feeling.
TP scale has been adjusted accordingly, the min/first value/column is 5.
TTPmin contains now 4 for the values > 2000rpm.
@idle, TP is about 6-7 now (at least >5 for sure).
When driving, if I release suddenly the throttle at high rpm > 6000, the rpm decreases slowly, in this case, TP=4 (=TTPmin and 4<5, checked this in logs), first fuel column is then accessed.
The problem is I get a ton of loud pop pop pops in the exhaust (kind of explosion) and I notice at the same time my AFR gauges don't display O2 as before (that means fully lean) but some values from 30 to 80. It would mean the ECU is still injecting a small amount of fuel when fully releasing the throttle !? Why ? I thought the ECU stops injection completely when throttle is released @high rpm !?
Could you give me some tricks ?
FYI, my void blast off time (aka injector latency) was 0x4B before, 0x70 now.
Matt,
I found out the issue, this is due to the 0xCA command that fails.
Have a look to the extract of log attached.
I (and Eric probably also) included a Consult write command provided originally by Pascal. This command is based on 0xCA and probably differs from your write protocol. Could you explain it ? (I just don't remember the write protocol of the 0xCA command provided by Pascal).
I patched my rom quickly with 0xCB not to interfere with yours and it works fine now
2)
Matt,
As I corrected the 1), I can now access to some new registers in Consult Tuner mode :
_Knock sense
_Fuel knock flag
But how to use them or to take them into account ? I cannot display the corresponding gauges and they don't appear in log files neither. Is there a link with the knock warning panel ?
Could you clarify ? Because these 2 knock indicators would be very helpful for me.
Does it require to map the knock registers in the Consult table (as mentioned, you added 140C and 140D at the end for TP).
FYI, I use the following to detect knock in my modified rom:
RAM1:005A flags10: rmb 1 ; ...
RAM1:005A ; Bit 2: 1=normal map, 0=knock map
RAM1:0082 flags8: rmb 1 ; ...
RAM1:0082 ; Bit 1: 1=inside knock learn region
RAM1:0082 ; Bit 7: 0=knoc
tim %100,flags10 knock map in use ?
beq knock_map_entered
tim %10000000,flags8 knock detection ?
beq knock_detected
RAM2:14BD knock_count: rmb 1
I forgot how this last one behaves exactly.
3)
Matt, Eric,
I take the benefit of this post to describe a trouble that occured with my 370cc to 740cc swap. I need your feeling.
TP scale has been adjusted accordingly, the min/first value/column is 5.
TTPmin contains now 4 for the values > 2000rpm.
@idle, TP is about 6-7 now (at least >5 for sure).
When driving, if I release suddenly the throttle at high rpm > 6000, the rpm decreases slowly, in this case, TP=4 (=TTPmin and 4<5, checked this in logs), first fuel column is then accessed.
The problem is I get a ton of loud pop pop pops in the exhaust (kind of explosion) and I notice at the same time my AFR gauges don't display O2 as before (that means fully lean) but some values from 30 to 80. It would mean the ECU is still injecting a small amount of fuel when fully releasing the throttle !? Why ? I thought the ECU stops injection completely when throttle is released @high rpm !?
Could you give me some tricks ?
FYI, my void blast off time (aka injector latency) was 0x4B before, 0x70 now.
- Attachments
-
- nistune-0517-1536part.log
- (15.76 KiB) Downloaded 145 times
[b] Custom tunes S13/Z32/GTIR. First Z32 flex fuel (E85/unleaded) [/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
In my case I didn't touch the consult routines...am using a standard 47P10 base image, where I modified and added some routines.
> I take the benefit of this post to describe a trouble that occured with my 370cc to 740cc swap. I need your feeling.
Sounds like it is overfueling at throttle release and dumps fuel in the exhaust.
your wideband may not register this as most of the fuel is already in the exhaust ?
> I take the benefit of this post to describe a trouble that occured with my 370cc to 740cc swap. I need your feeling.
Sounds like it is overfueling at throttle release and dumps fuel in the exhaust.
your wideband may not register this as most of the fuel is already in the exhaust ?
-
RomChip200
- Posts: 426
- Joined: Mon May 11, 2009 7:58 pm
- Location: FRANCE
I tried the 47P10 oem image, and it worked fine. Seems you added some routines that interact with Nistune, maybe it conflicts with some add-ons of Nistune.
I would like an exhaustive list of what Matt mods in the rom.
At least, there's 140C 140D @EA4E @EA4F (as described by Matt)
I retrieved the protocol of 0xCA write command from Pascal.
It's CA 16 E8 00 F0 : it writes 00 in 16 E8
Matt's command: CA 02 EA 00 10 !?
Regarding my pop sounds in exhaust on throttle release, it seems to be linked to the latency value. Putting 1.12ms i.e 0x70 instead of 1.22ms i.e. Ox7A behaves better (my AFR gauges display more often O2 now).
But Deatschwerks specified for the 740cc, 1.12ms @15V and 1.22ms @14V.
I was surprised b/c the values are pretty high but they told me they tested themselves the real latency.
from Mike Deatsch <mike@deatschwerks.com>
to "Didier"
date 6 mai 2009 21:26
objet Re: About 740cc kit for 300zx 90-93
The latency time for the 740’s is below. 6v-17v in 1v increments. I do not believe that the value the OEM ECU lists for latency is an actual latency value. I believe it is a derived value. We have tested latency times on hundreds of injectors and compared our results with other companies. .65ms on a high impedance injectors is not realistic. The below values are actual latency values listed in ms. I do not believe the OEM ECU displays latency values in the same manner.
Hope that helps
3.36 2.63 2.25 1.94 1.71 1.57 1.40 1.30 1.22 1.12 1.08 1.00
I would like an exhaustive list of what Matt mods in the rom.
At least, there's 140C 140D @EA4E @EA4F (as described by Matt)
I retrieved the protocol of 0xCA write command from Pascal.
It's CA 16 E8 00 F0 : it writes 00 in 16 E8
Matt's command: CA 02 EA 00 10 !?
Regarding my pop sounds in exhaust on throttle release, it seems to be linked to the latency value. Putting 1.12ms i.e 0x70 instead of 1.22ms i.e. Ox7A behaves better (my AFR gauges display more often O2 now).
But Deatschwerks specified for the 740cc, 1.12ms @15V and 1.22ms @14V.
I was surprised b/c the values are pretty high but they told me they tested themselves the real latency.
from Mike Deatsch <mike@deatschwerks.com>
to "Didier"
date 6 mai 2009 21:26
objet Re: About 740cc kit for 300zx 90-93
The latency time for the 740’s is below. 6v-17v in 1v increments. I do not believe that the value the OEM ECU lists for latency is an actual latency value. I believe it is a derived value. We have tested latency times on hundreds of injectors and compared our results with other companies. .65ms on a high impedance injectors is not realistic. The below values are actual latency values listed in ms. I do not believe the OEM ECU displays latency values in the same manner.
Hope that helps
3.36 2.63 2.25 1.94 1.71 1.57 1.40 1.30 1.22 1.12 1.08 1.00
1. If CA command responds then we assume that the board is using 'extended consult' and the C9 command is not available
CB replacement is good still when using stream mode
2. Knock sense no longer used. Replaced with a read knock count specialized command
Fuel knock flag register is used and will be read to determine whether to select main/knock fuel maps on the screen and highlight them pink
There are no gauges for this
I've been looking at the Z32 knock counting recently but having trouble getting it to trigger properly on the bench. Still under investigation
-
Eric - I would need to look at the modified ROM code
We use an area of RAM for internal storage, patched areas of ROM for consult routine locations and jmps around some parts of the consult routine
Basically I replace C9 code to take the command buffer and process and process in an external patch area
eg
CA = nistune command
02 = read bytes subcommand
EA 00 = address
10 = num bytes to read
for streaming bytes I modified the stream code to pass out what I need and then stop the stream automatically (so streams 10 bytes then stops)
sounds like pascal did something similar to me. but I use subcommands for read/write/burn/pin and multiple bytes to increase speed
CB replacement is good still when using stream mode
2. Knock sense no longer used. Replaced with a read knock count specialized command
Fuel knock flag register is used and will be read to determine whether to select main/knock fuel maps on the screen and highlight them pink
There are no gauges for this
I've been looking at the Z32 knock counting recently but having trouble getting it to trigger properly on the bench. Still under investigation
-
Eric - I would need to look at the modified ROM code
We use an area of RAM for internal storage, patched areas of ROM for consult routine locations and jmps around some parts of the consult routine
Basically I replace C9 code to take the command buffer and process and process in an external patch area
eg
CA = nistune command
02 = read bytes subcommand
EA 00 = address
10 = num bytes to read
for streaming bytes I modified the stream code to pass out what I need and then stop the stream automatically (so streams 10 bytes then stops)
sounds like pascal did something similar to me. but I use subcommands for read/write/burn/pin and multiple bytes to increase speed
-
RomChip200
- Posts: 426
- Joined: Mon May 11, 2009 7:58 pm
- Location: FRANCE
Regarding RAM2:14BD knock_count: rmb 1,
As far as I can see in assembler code, this variable can take only 2 values on Z32, 0 or 1 b/c knock_max=0
CODE:AC44 tim #%1000, flags2 ; Bit 0: 0=first time, 1=not first time
CODE:AC47 beq loc_6321
CODE:AC47
CODE:AC49 ldaa knock_count
CODE:AC4C cmpa knock_max
CODE:AC4F bcc loc_1012
CODE:AC4F
CODE:AC51 inc knock_count
CODE:AC54 bra loc_1012
CODE:AC54
CODE:AC56
CODE:AC56 loc_6321: ; ...
CODE:AC56 ldaa knock_count
CODE:AC59 beq loc_1012
CODE:AC59
CODE:AC5B dec knock_count
CODE:AC5E
CODE:AC5E loc_1012: ; ...
Its value is substracted later in ign_timing_set routine,
CODE:85DF ldab ign_var15
CODE:85E2 subb knock_count
CODE:85E5 subb irq2_var1
CODE:85E8 subb ign_var8
CODE:85EB
As far as I can see in assembler code, this variable can take only 2 values on Z32, 0 or 1 b/c knock_max=0
CODE:AC44 tim #%1000, flags2 ; Bit 0: 0=first time, 1=not first time
CODE:AC47 beq loc_6321
CODE:AC47
CODE:AC49 ldaa knock_count
CODE:AC4C cmpa knock_max
CODE:AC4F bcc loc_1012
CODE:AC4F
CODE:AC51 inc knock_count
CODE:AC54 bra loc_1012
CODE:AC54
CODE:AC56
CODE:AC56 loc_6321: ; ...
CODE:AC56 ldaa knock_count
CODE:AC59 beq loc_1012
CODE:AC59
CODE:AC5B dec knock_count
CODE:AC5E
CODE:AC5E loc_1012: ; ...
Its value is substracted later in ign_timing_set routine,
CODE:85DF ldab ign_var15
CODE:85E2 subb knock_count
CODE:85E5 subb irq2_var1
CODE:85E8 subb ign_var8
CODE:85EB
[b] Custom tunes S13/Z32/GTIR. First Z32 flex fuel (E85/unleaded) [/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
[b] 300ZX Z32 '90 400ch 100% E85[/b]
[b] 200SX S13 '92 220ch 100% E85[/b]
[b] Audi S4 B5 '99 400ch 100% E85[/b]
i've seen that disassembly before on the ECU tuning forums and I had a look through it before. I couldnt see where the count was coming from or where it was being used
So I'm not sure that is actually a knock count?
see below:
So I'm not sure that is actually a knock count?
see below:
later on where knock counts are checked to determine map to use:B671 : 7B 20 82 "{ " tim #$20X0082 // KNOCK_REG (check)
B674 : 26 1F "& " bne LB695 // knock bounds flag clear
B676 : B6 FF C5 " " ldaa XFFC5
B679 : 5F "_" clrb
B67A : FD 14 6B " k" std X146B FILTERED_KNOCK_COUNT5
B67D : 72 10 B0 "r " oim #$10X00B0 // set KNOCK_DTC
B680 : 72 10 49 "r I" oim #$10X0049 // set KNOCK_DTC (sets DTC code)
B683 : 7F 00 83 " " clr X0083
B686 : 7F 16 BD " " clr X16BD
B689 : 71 7E 82 "q~ " aim #$7EX0082 // clear KNOCK (set REG)
[/list]B807 : 7B 80 82 "{ " tim #$80X0082 // check KNOCK=80 (HIGH)
B80A : 26 0D "& " bne LB819
B80C : B6 16 10 " " ldaa X1610 FILTERED_KNOCK_COUNT // get knock count
B80F : B1 F4 53 " S" cmpa XF453 KNOCK_MAX // check if knock count > amount
B812 : 2F 10 "/ " ble LB824
B814 : 72 80 82 "r " oim #$80X0082 // set KNOCK=80 (HIGH FUEL)
B817 : 20 0B " " bra LB824
;
B819 LB819:
B819 : B6 16 10 " " ldaa X1610 FILTERED_KNOCK_COUNT // get knock count
B81C : B1 F4 52 " R" cmpa XF452 KNOCK_MIN // check if knock count > amount
B81F : 2E 03 ". " bgt LB824 // if not then
B821 : 71 7F 82 "q " aim #$7FX0082 // clear KNOCK=80 (REG FUEL)
B824 LB824:
B824 : 39 "9" rts