Ford Universal ADX

Any TunerPro specific issues belong here.
wwhite
Posts: 316
Joined: 2021 Feb 16, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: Ford Universal ADX

Unread post by wwhite »

efloth wrote: 2021 Feb 24, 20:07 Are the extra values in the parameter list just garbage left over?
No, some of them are bytes. The 0000 and 1F1F are separators i think. You have to step through the logging code to figure out exactly what's going on.
If the Payload references values like 0x0D8D(twice) that were not copied by the patch then how could that data be relevant? Placeholders?
8D is a byte. The memory location 0x8c is copied by the patch. One word of 0x8c includes 2 bytes (0x8c and 0x8d), stored [0x8d], [0x8c].
The only AD channel that is being referenced by the payload is ChB. Is that normal?
Could be, depends. The other channels probably are read into a register, and stored there as a value.
Then, that value is probably used in another equation, or compared with max/min, clipped, etc... then stored in a different register, which is then shadowed copied and read by payload.
The AD channel registers would be the RAW data, may or may not be useful.
efloth
Posts: 298
Joined: 2021 Feb 15, 22:12
Location: Sacramento CA
Vehicle Information: 1991 F150 4.9L J1X 80lb Injectors E85
1995 F150 5.8L MOB1

Re: Ford Universal ADX

Unread post by efloth »

Thanks for the input, I am getting there :)
B7 confuses me. It is called by the payload from its shadow location of 0DB7 but was never copied there by the patch routine. 0D8D is a similar situation along with 91, B9, DB, 96 and D9. Also Placing the payload names in order are not lining up as documented. I think I need to skip over some of these but not sure which ones an why.

Code: Select all

ADX	    PL		Name							J1X equivalent
01 03 1F 1F 1F1F	-
02 03 0D D6 00D6	ATMR1		
02 03 03 96 0396	IPSIBR
01 03 0D B6 00B6	ECT								B4
01 03 0D B7		ACT								B5
02 03 0D 9A 009A	AM
02 03 0D CC 00CC	SAFTOT
02 03 0D BA 00BA	LOAD
02 03 0D B4 00B4	N
02 03 01 24 0124	PERLOAD
02 03 0D 8A 008A	RATCH
02 03 01 62 0162	-
02 03 01 F2 01F2	VMAF
02 03 0D BE 00BE	IEGR
02 03 0D 96 0096	LAMBSE1
02 03 01 70 0170	KAMRF1
02 03 01 1A 011A	IEGO1
02 03 01 54 0154	DASPOT
02 03 0D 92 0092	ISCDC
01 03 0D 8D		VSBART_RT
01 03 0D 8D		VSBAR
02 03 1F 44		Bitmasks
01 03 0D 91		VBAT
01 03 0D B9		ACT
02 03 0D B2 00B2	TP
01 03 0D A8 00A8	FUEL_APT_LST
01 03 01 5C 015C	ISCFLG
02 03 01 6A 016A	FUELPW1
01 03 01 5D 00DA	PDL
01 03 0D DB		AEFUEL
01 03 1F 1F		EFTFRR
01 03 02 1B		WOTTMR
01 03 1F 1F		PIPCTR
01 03 02 28		LAMBSE2
01 03 01 4E 014E	KAMRF2
01 03 02 39		IEGO2
02 03 0D 96		-
02 03 01 70		BCSDC
02 03 01 1A		NOBART
01 03 1F 1F		GR_CM
01 03 1F 5D		-
02 03 1F 20		TV_PRES
02 03 1F 20		Bitmasks
01 03 0D D9		SP**AHISL
01 03 1F 1F		TOT
01 03 03 5C		SPD_RATIO
01 03 1F 1F		-
02 07 FF FE		SPK_SOURCE
02 03 03 14 0314	Bitmasks
02 03 03 22 0322
02 03 01 6C 016C
01 03 03 98 0398
decipha
Posts: 5031
Joined: 2021 Feb 15, 12:23
Location: Metairie, LA
Vehicle Information: Work Truck
'19 F-150 3.3L

Re: Ford Universal ADX

Unread post by decipha »

I shadow words only. So b7 comes in with b6.

0000 is the end of the shadowing list. Then is my bitstacking list. Its detailed in my disassembly write up.

you have to keep track of bytes and words being read
decipha
Posts: 5031
Joined: 2021 Feb 15, 12:23
Location: Metairie, LA
Vehicle Information: Work Truck
'19 F-150 3.3L

Re: Ford Universal ADX

Unread post by decipha »

This is my datalogging code broken down.

Code: Select all

 <-------Standardized ADX Patch Code------->
   Subr_StandardizedADX():
8ff8e: 90,a1,00           orb   R0,Ra1           R0 |= flag_reg24;                 // execute removed code which is the raminit
8ff91: ff                 nop                                                      //list of payload operations at 0xFE00
8ff92: 32,10,00           jnb   B2,R10,8ff95     if (B2_HSO_IntPend1 = 0) goto 8ff95;
 
<----Loop Words() til value of 0000is reached---->

Shadow_Words():  // shadow word ram addresses first
8ff95: a2,33,36           ldw   R36,[R32++]      tmp2l = [temp7l];                 // r36 contains RAM address, R32 contains next address
8ff98: 88,36,00           cmpw  R0,R36                                             // end of list check; break to bytes list
8ff9b: df,0a              je    8ffa7            if (tmp2l != 0)  {                // R38= RAM_ADDRESS_VALUE
8ff9d: a2,36,38           ldw   R38,[R36]        tmp3l = [tmp2l];                  // save ram value to shadow address 
8ffa0: c3,37,00,c0,38     stw   R38,[R36+c000]   [tmp2l+c000] = tmp3l;             // Loop until end of word list is reached
8ffa5: 27,ec              sjmp  8ff93            goto 8ff93; }

8ffa7: 01,30              clrw  R30              temp6l = 0;
<----Broke Loop, all byte ram addresses are now shadowed--->

Setup_New_Stack_Byte():  // done once for every stacked byte
8ffa9: 01,40              clrw  R40              tmp7l = 0;                        // r30offset to save to 0x1F_[R30]; doubles as next flag
8ffab: b1,01,42           ldb   R42,1            tmp8l = 1;                        // r40byte thats stacking bit flags   // r42 current bit position
8ffae: 10,00              bank  0
8ffb0: a2,33,36           ldw   R36,[R32++]      tmp2l = [temp7l];

Shadow_Bits():  // stack bits to standardize flag addressing                      // R36=ram address; R32 == bit position and XX offset (1FXX)
8ffb3: 88,36,00           cmpw  R0,R36           
8ffb6: df,38              je    8fff0            if (tmp2l = 0) goto 8fff0;
8ffb8: 89,fe,ff,36        cmpw  R36,fffe                                           // check if end of list; break to end   // fffe value means to skip that bit position 
8ffbc: df,26              je    8ffe4            if (tmp2l = fffe) goto 8ffe4;
8ffbe: b2,36,38           ldb   R38,[R36]        tmp3l = [tmp2l];                  // R38= bitmask_ram_value;
8ffc1: 10,00              bank  0
8ffc3: a2,33,34           ldw   R34,[R32++]      tmp1l = [temp7l];                 // R34 = bit position,offset  <--- operational code
8ffc6: 99,00,30           cmpb  R30,0            
8ffc9: df,0b              je    8ffd6            if (temp6l = 0) goto 8ffd6;
8ffcb: 98,35,30           cmpb  R30,R35                                            // check if new shadow stack byte
8ffce: df,06              je    8ffd6            if (temp6l = tmp1h) goto 8ffd6;
8ffd0: 69,04,00,32        sb2w  R32,4            temp7l -= 4;                      // if new bitmask address (doesn't match) current then go save current bitmask   // go back up th
                                                                                   e operations list to find the shadow address
8ffd4: 20,1a              sjmp  8fff0            goto 8fff0;

8ffd6: b0,35,30           ldb   R30,R35          temp6l = tmp1h;                   // end of current bitmask byte, go save current stacked byte
<----New Byte to Stack Bitmasks---->                                               // R30== new shadow address
8ffd9: 70,34,38           an2b  R38,R34          tmp3l &= tmp1l;                   // check if ram bitmask is set
8ffdc: 98,38,00           cmpb  R0,R38           
8ffdf: df,05              je    8ffe6            if (tmp3l = 0) goto 8ffe6;
8ffe1: 90,42,40           orb   R40,R42          tmp7l |= tmp8l;                   // if ram bit is not jump to skip enabling stacked bit;   // enable stacked bitmask 
8ffe4: 01,38              clrw  R38              tmp3l = 0;
8ffe6: 99,80,42           cmpb  R42,80                                             // clear test flag for next loop; or set unlogged value to 0; or // "skip"   // check if at bit7 
                                                                                   == last position of stacked byte
8ffe9: df,05              je    8fff0            if (tmp8l = 80) goto 8fff0;
8ffeb: 7d,02,42           ml2b  R42,2            tmp8l = tmp8l * 2;                // if end go save new stacked byte of bitflags   // increment to next bit, bit shift <<
8ffee: 27,be              sjmp  8ffae            goto 8ffae;

8fff0: 99,00,30           cmpb  R30,0                                              // loop to do next bitmask position check
8fff3: df,08              je    8fffd            if (temp6l = 0) goto 8fffd;
8fff5: b1,1f,31           ldb   R31,1f           temp6h = 1f;                      // break to end; else check to see if a current bitmask is in progress (next flag)   // 0x1F is a
                                                                                   lways the shadows address range
8fff8: c6,30,40           stb   R40,[R30]        [temp6l] = tmp7l;
 
<----NOW is LATER, save the new flag value---->                                    // save stacked byte to shadow bitmasked byte
8fffb: 27,aa              sjmp  8ffa7            goto 8ffa7;

8fffd: f0                 ret                    return;                           // reset bitmasks temporary variables to do next stacked byte
Here is my notes for keeping track of the offsets and payloads

Code: Select all

offset	PID Name	bytes	RZASA
0	1f1f BLANK / VSF	1	f355
1	ATMR3_HI_RES / ATMR1_HI_RES	2	15FE
3	desmaf_pid_n	2	140E
5	ECT	1	79
6	ACT or SC_MCT	1	7B
7	AM	2	134C
9	SAFTOT	2	1794
11	LOAD_FG / LOAD_LAST	2	17ba
13	NFIL	2	1218
15	PERLOAD	2	1372
17	RATCH	2	136
19	TOTLDST	2	F018
21	IMAF	2	17E
23	IEGR / MAP_CNTS	2	158
25	LAM_FINAL1	2	44E
27	KAMRF1	2	7A4
29	IEGO11	2	15c
31	DASPOT	2	1418
33	ISCDTY / iac_op_frac	2	126
35	VSBART_RT	1	127d
36	BP	1	
37	2XXXXX_FLAGS	2	1f44
39	VBATBAR / vbat	1	1405
40	CHT_LONG_byte or ACT or TCSTRT	1	11f1
41	TP	2	122
43	FUEL_APT_LST	1	640
44	ISCFLG	1	144d
45	FUELPW1	2	012c
47	SPK_DSDRPM	1	1449
48	PDL	1	1270

49	TFC_HR_LBM / TFC_HR	2	1c8

51	EFTR / TFC_HR_LO / tfc_hr_hi	2	1c6
53	EGR_WOT_TMR / COOL_WOT_TMR	1	16c1
54	CRKPIPCTR_BW	1	1360
55	LAM_FINAL2	2	450
57	KAMRF2	2	7A6
59	IEGO21	2	164
61	NUM_CODES	1	77a
62	OL_DES	1	1f5d
63	BCSDC_OUT	2	1230
65	NOBART	2	1264
67	GR_CM	1	1288
68	FN725A_ACT	1	f225
69	TV_PRES	1	1297
70	fuel_flags	1	1f65
71	SP**AHISL	2	06x1FFE
73	was unassigned 1f67		
73	TOT	2	2AC
75	SPD_RATIO	2	1226
77	KNKTST_A2D	2	
79	SPK_SOURCE	1	637
80	flags INJFAULTS	1	1f6f
81	EADT / EOT or INF_EOT	2	F45E
83	VS_RATEPH	2	1276
85	FUL_ADD_CLD	1	1354
86	LOST_ALT_MUL	1	f114
87	FPUMP_DC	2	1132
89	FIP_DELTA	2	F0F2
91	FP_FLOWRATE	2	F322
93	SPK_ACTUAL / saf_fg	2	F0DE
95	LOST_FUEL__A	2	F112
97	LBMF_INJ1	2	137e
99	PGM_TANK_PRS	2	f1ce
101	IF_FUEL_LVL / PGM_FUEL_LVL	2	2F8
103	SPK_BDL	2	E90
105	SPK_MBT_LAST	2	E9A
107	FP_INPUT_VLT	1	f30f
108	SPKAD	1	1799
109	INFAMB_KAM	2	F526
	← END WORD LIST →  ← END OF DMA → 		everything below here is done in the xdf with the logging list
			
			
	← PUT THIS IN OPS LIST AFTER ALL DMA ADDRESSES ARE SHADOWED AND NOW STACK THE BITMASKS IN TO BYTES IN THIS EXACT ORDER SO IT IS POLLED CORRECTLY →		
	0		0
	OL_DES		94
1f5d	1f5d bit 0		5d02
	WOT		90
1f44	BIT 0		4401
	UNDSP		98
	BIT 2		4404
	FUEL_IN_SYNC		008E
	BIT 7		4480
	ACCFLG		00C1
	BIT 2		4404
	HSF_FLG		014F
	BIT 7		4480
	LSF or LSF_FLG		377
	BIT 7		4480
	NDSFLG		009D
	BIT 7		4480
	OL_DES – free open		94
	BIT 1		4402
	MASTER_KEY / ECT_STABL / flg_stablect		1757
	BIT 5		4520
	FRP_FAULT ?		04D6
	BIT 7		4580
	KNK_FMEM_1		07C4
	BIT 4		4510
	AICE_KNKINIT		92
	BIT 5		4520
	KNK_HIGH		00A5
	BIT 2		4504
	LEGOFG11		07C2
	BIT 7		4580
	MIL		006C
	BIT 3		4508
	MISFIRING		00B8
	BIT 1		4502
	OCTADJ / DFSFLG		13F2
	BIT 6		6540
	CL_THRTL		00D0
	BIT 7		6580
	DFSFLG		00B1
	BIT 7		6580
	BOO_LVL		58
	BIT 3		6508
	FLG_OLUP / OLFLG		00B0
	BIT 4		6510
	FLG_ADPT_RST		13F4
	BIT 0		6501
	DO_KOEO_TST  / EO_TST_ENA		00BE
	BIT 5		6520
	FLASH_TCIL / MIL_FLASH		03B6
	BIT 7		6580
	INJ1_FAULT		006F
	BIT 0		6F01
	INJ2_FAULT		6F
	BIT 1		6F02
	INJ3_FAULT		70
	BIT 0		6F01
	INJ4_FAULT		70
	BIT 1		6F02
	INJ5_FAULT		71
	BIT 4		6F10
	INJ6_FAULT		71
	BIT 5		6F20
	INJ7_FAULT		71
	BIT 0		6F01
	INJ8_FAULT		71
	BIT 1		6F02
	← END BITS LIST →		0
	← END ALL LISTS →		0
you can reference my payloads write up as well.

http://www.efidynotuning.com/payloads.htm

And here is my datalogging ops list function in rzasa .
You can open up tunerpro and uncheck the reverse rows box under preferences so you can type it in.
That's how i do it.

Code: Select all

0078
007A
0136
017E
0158
015C
0126
0122
012C
01C8
01C6
0164
02AC
02F8
0000
0094
5D02
0090
4401
0098
4404
008E
4480
00C1
4404
014F
4480
0377
4480
009D
4480
0094
4402
1757
4520
04D6
4580
07C4
4510
07C2
4502
00A5
4504
07C2
4580
006C
4508
00B8
4502
13F2
6540
00D0
6580
00B1
6580
0058
6508
00B0
6510
13F4
6501
00BE
6520
03B6
6580
006F
6F01
0070
6F01
0070
6F02
0071
6F10
0071
6F20
0071
6F01
0071
6F02
0000
0000
It should be pretty straight forward. Post back if you need more clarity.
efloth
Posts: 298
Joined: 2021 Feb 15, 22:12
Location: Sacramento CA
Vehicle Information: 1991 F150 4.9L J1X 80lb Injectors E85
1995 F150 5.8L MOB1

Re: Ford Universal ADX

Unread post by efloth »

I believe I have pulled the correct addresses for most everything. Many of the subroutines are obviously the same so it was pretty easy to find thanks to all of your hard work. How many years did it take to break out the first strategy? :shock:

There are a few entries after 0000 in the parameter list that I am unclear on. I don't see any disassembly references to:

Code: Select all

0027
5D01
009E
I've attached my excel worksheet with notes. Do you see any issues? I should have the motor back together this weekend so hoping to test datalogging on my stock bin at the same time :)
Attachments
A1C-J1X Payload.zip
(15.02 KiB) Downloaded 398 times
wwhite
Posts: 316
Joined: 2021 Feb 16, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: Ford Universal ADX

Unread post by wwhite »

Packet offset 0x25, is QH_Flags24, open loop flags?
Packet offset 0x26, is probably for another definition, not A1C?
Packet offset 0x27 is 009e, I think is QH_VBAT.

I did the same thing as you, created a spread sheet.
efloth
Posts: 298
Joined: 2021 Feb 15, 22:12
Location: Sacramento CA
Vehicle Information: 1991 F150 4.9L J1X 80lb Injectors E85
1995 F150 5.8L MOB1

Re: Ford Universal ADX

Unread post by efloth »

Thanks for all the help. I am logging successfully on my stock bin. I have a few mistakes in the above sheet that I am working out but I have most all of the dashboard working correctly.
Post Reply