qh issue with tunerpro on a lb3 ecu

[Boostcoupe]

ok so this is on my 1986 turbocoupes, so i swapped my pc1 and small vam to a lb3 and large vam, did the pin swap got it together and it runs great so far.
so i put the quarterhorse on it, i downloaded the la3bin from eecanalyzer.net(only place i found any of the 2.3t bins) and loaded it into the QH, it starts but running rich (9.7 on my wideband) and i am assuming the timing is way retarded with a sluggish rev and i can hear the turbo spooling.

i tried downloading an lb3 bin with the same result, and i also tried reading the stock lb3 bin off the ecu, which i believe i did it right and that one also runs the same, but i can pop the QH off the j3 port and it runs great on the stock tune.

this is using tunerpro rt, the t23b.xdf, universal adx from here, everything seems to be connecting fine and uploading to the QH fine, it seems this should be plug and play right? could it be that the bin files are meant for BE? or should that even matter?

[decipha]

i never wrote the patch code for the turbo coupe

read out your stock tune and post it, when i get time ill post up an xdf with te logging code

[Boostcoupe]

that would be awesome,

hopefully i am doing this right lol, thanks decipha for the help

[decipha]

no thats not right its only 16k, read out the full 56k even though your ecu isn't but 32k or prob less it would be ideal so we get it all

details are in the getting started write up on the homepage

[Boostcoupe]

ok i think i got it now lol.

[decipha]

did u write it to the qh and verify all is well?

[Boostcoupe]

yes just did and it runs good no issues.

[decipha]

excellent, as time permits i'll rip through it and post up an xdf for it, its not priority so it'll be months before i do it unless someone specifically gets development for it, but it'll be on the list, i'll prob write some extra code for it as well to do some pretty neat things as well considering the capabilities are less than desire-able with the VAF

[motorhead1991]

I have a padded LA3 already, and it plays well with the T23B xdf.

If I knew the RAM addresses I could whip up the patch sometime soon.

[jsa]

LA* and LB* acquired from all over the web.

Some have been tweaked for MAF code, so would not work for VAF.
The defs may need updating for them to work in BE12.

You could take the info from the defs and transfer it into TP.

Motorhead, correct or not, there are patchcodes and payloads in the defs.

[Boostcoupe]

excellent, as time permits i'll rip through it and post up an xdf for it, its not priority so it'll be months before i do it unless someone specifically gets development for it, but it'll be on the list, i'll prob write some extra code for it as well to do some pretty neat things as well considering the capabilities are less than desire-able with the VAF

thanks that will be great!! ya i definitely want to get rid of the vam just still researching what would be the best route to go, aka speed density, maf, ecu swap.
i want to stick with eec and QH just for the fact that i have 2 other fords to tune and would rather not buy a megasquirt for each car.

[Boostcoupe]

I have a padded LA3 already, and it plays well with the T23B xdf.

If I knew the RAM addresses I could whip up the patch sometime soon.

not sure if you are referring to me or decipha? i wouldnt know where to find the ram addresses, i am fairly green in the eec tuning world lol.

[Boostcoupe]

LA* and LB* acquired from all over the web.

Some have been tweaked for MAF code, so would not work for VAF.
The defs may need updating for them to work in BE12.

You could take the info from the defs and transfer it into TP.

Motorhead, correct or not, there are patchcodes and payloads in the defs.

thanks, i saved those and will see what i can figure out, it seems most of the 2.3t stuff is geared towards BE, i guess i may have to bite the bullet and purchase BE also.

[jsa]

, it seems most of the 2.3t stuff is geared towards BE, i guess i may have to bite the bullet and purchase BE also.

That's what it boils down to. Use the software that has your catchcode definition or expend a lot of resources on making a definition for another software package.

[oharris]

ok so this is on my 1986 turbocoupes, so i swapped my pc1 and small vam to a lb3 and large vam, did the pin swap got it together and it runs great so far.
so i put the quarterhorse on it, i downloaded the la3bin from eecanalyzer.net(only place i found any of the 2.3t bins) and loaded it into the QH, it starts but running rich (9.7 on my wideband) and i am assuming the timing is way retarded with a sluggish rev and i can hear the turbo spooling.

i tried downloading an lb3 bin with the same result, and i also tried reading the stock lb3 bin off the ecu, which i believe i did it right and that one also runs the same, but i can pop the QH off the j3 port and it runs great on the stock tune.

this is using tunerpro rt, the t23b.xdf, universal adx from here, everything seems to be connecting fine and uploading to the QH fine, it seems this should be plug and play right? could it be that the bin files are meant for BE? or should that even matter?

I am having the same issue with an LA ECU. I did exactly as you did (downloaded the BIN from EECanalyzer, and loaded it) and it does exactly as you describe (runs extremely rich). I also tried loading the LA3 bin and it did the same thing. Did you ever solve this? How did you read the stock BIN off the chip?

Also, I found the the addresses in the t23b.xdf were off by x2000 compared to the BE definition. Looking at various scalers, they were nonsense. Idle for instance said it was 4000ish RPM. I fixed it by changing the header to subtract x2000 and became 900 RPM.

[decipha]

with the egr input open it seems like the best method would be to just use either a maf sensor or a map sensor (voltage based) to make it pretty straight forward.

A few years back I started going through one of the svo/turbocouple strats can't remember which i thin it was an la file but in any case, if someone wanted to expedite development it wouldn't take much

[oharris]

with the egr input open it seems like the best method would be to just use either a maf sensor or a map sensor (voltage based) to make it pretty straight forward.

A few years back I started going through one of the svo/turbocouple strats can't remember which i thin it was an la file but in any case, if someone wanted to expedite development it wouldn't take much

There is no EGR input on any 2.3T EEC AFIK. At least not the LA, LA3 and PE I plan on eventually going to SVOJohn's SD setup, but first I just want to get it work right. What does it take to get your universal ADX file to run with the LA?

[decipha]

same as any strat, just add in the jump and order the payloads

[motorhead1991]

Started on the disassembly. The console routine is at 766e

[oharris]

same as any strat, just add in the jump and order the payloads

Now you've lost me. Add in the jump? What is that?

Order the payloads? I assume that's picking the things you want to log (LAMSE, spark advance, RPM, etc.) Is that correct?

I tried following your instructions on this page but I'm stumped.

I downloaded the adx and I already have the xdf. Steps 1-4 are easy enough, but step 5 I get no results. There was only one file in the zip that I downloaded, is there supposed to be a patch file too?

[motorhead1991]

same as any strat, just add in the jump and order the payloads

Now you've lost me. Add in the jump? What is that?

Order the payloads? I assume that's picking the things you want to log (LAMSE, spark advance, RPM, etc.) Is that correct?

I tried following your instructions on this page but I'm stumped.

I downloaded the adx and I already have the xdf. Steps 1-4 are easy enough, but step 5 I get no results. There was only one file in the zip that I downloaded, is there supposed to be a patch file too?

The "patch" is built into the XDF. I'll get started on that tonight, after I pick a spot in the time to put the code and logging table.

[motorhead1991]

OK so, this console routine is different from what I'm used to, so we may have to go deeper into the code or rewrite it entirely. Since I'm mostly lost at this point, decipha may have to do it...

[decipha]

no big deal when i get some free time i'll toss it in there

[oharris]

Thanks decipha. I take it you have to do something to the xdf to make this happen or are you modifying the adx?

In the mean time I think I've managed to solve the original problem. It seems BE has the ability to place the tune wherever you specify. ie. starting at x2000 (8K). Tuner Pro seems to lack this ability so in order to write a bin from BE you have to pad the bin with 8K of nulls. Is that correct? I did just that and loaded it and it seems to run normally now.

[decipha]

neither i have to run through the bin and see where to put the patch code then line up the payloads in the correct order

no thats incorrect, simply click on xdf >> view/edit xdf header info >> set the base offset to 2000 and click subtract

[oharris]

no thats incorrect, simply click on xdf >> view/edit xdf header info >> set the base offset to 2000 and click subtract

I tried that. It worked fine as far as the xdf was concerned. I was able to read and edit the bin and it had reasonable values. When I tried to write the bin to the QH, it didn't work at all The first clue was the fuel pump ran continuously with the key on instead of shutting off after a few seconds. To my great surprise I was able to start it, but it ran super rich. Basically the same symptoms Boostcoupe had at the beginning of this thread. I read somewhere else about stripping the first 8K off a tuner pro bin to use it in other programs, so I reasoned that I needed to add it to use with tuner pro. Once it did that, it ran like stock. Maybe there's a setting somewhere that accounts for the xdf header offset when writing the bin, but I can't find it.

[jeeptech77]

Decipha i am running a la3 on maf , i am at the point where i need to learn how to figure out how to assign payloads/or even find payloads
example : i move a function it has an assigned payload
the function started in 0x109c with a payload address of 0x0076
function new address is 0XADO PAY LOAD UNKNOWN ! DATA FOR 0X109C IN THE FUNCTION STILL OPERATES
BUT THE PAYLOAD ADDY IS NO LONGER CORRECT
THIS IS ON BINARY EDITOR SO ADD 2000 TO THE HEX
SO THE BEST WAY I CAN FRAME THIS QUESTION
READING THE DISSEMBLY IN SAD OR HOWEVER U RECCOMEND? HOW DO I IDENTIFY A PAYLOAD FOR A SPECIFIC TASK??
THIS IS JUST ONE EXAMPLE OF WHAT I NEED TO LEARN TO CONTINUE ON MAKING A DEF THAT WILL BE FULLY FUNCTIONAL
I HAVE MANY OTHER THINGS WITH LESS PRIORITY THAT I WILL APPLY THIS TO

[decipha]

109c would be invalid ram unless its 309c your talking about the code being at

ad0 is ram unless 2ad0 which is code/rom

I dont understand what your asking

you say function new address, are you rewritting code and moving functions addressing or are you referring to a doffrrent function you want to add to your def file?

0x76 is a ram address. If its being loaded in to a scratch register before the function address is loaded in and a call to an interpolation routine then its safe to assume its the payload or ram address for that function. First you need to identify the address PID and figure out what its for. Once you do just toss it in line according to the polling order in the disassembly write up.

Only way to identify the ram address is to identify what the code is doing with that address.

[jeeptech77]

0x309c thats adding 2000 - 0x109c is what binary editor has to use as an input.
as it has a 2000 offset or whatever u want to call it

so what i have done is moved 0x309c to 0x2AD0 TO CREATE ROOM FOR A LARGER MAF TRANSFER FUNCTION
I NEED TO FIGURE OUT HOW TO MOVE THE PAYLOAD TO MATCH THE NEW ADDRESS , OR FIND THE PAYLOAD FOR THAT ADDRESS
IT IS THE IAT TRANSFER TABLE
THE PAYLOAD FOR 0X109C IS 0X2076

EVERYTHING IN THE DISSEMBLY WRITE UP HAS MOSTLY INFO ON TPRT IT IS ALL VERY CONFUSING
I AM NOT USING TPRT ,SO AS FAR AS POLLING ORDER I HAVE NO IDEAL IF IT APPLIES TO B-E
I NEED TO KNOW HOW TO FIND THE HEX ADDRESS THE NEW PAYLOAD IS AT TO ENTER INTO THE STRATEGY
SORRY FOR THE CONFUSION IM TRYING TO BE AS CLEAR AS POSSIBLE I DO NOT ALWAYS KNOW THE CORRECT TERMINOLOGY FOR THINGS TO DO WITH OP CODES AND SO ON .

[decipha]

the payload doesnt move it stays the same

why not just move the maf transfer to the tail end of rom?

2076 isnt a payload, ram is lower addressing so its just 76
you cant move ram unless you have nothing better to do than devote your life to finding every reference and changing it

moving functions does not affect ram addressing.

[jeeptech77]

the payload doesnt move it stays the same
OK HOW DO I REASSIGN FUNCTIONS ? I ASSUME NOT KNOWING THAT THE SUBROUTINE IS THE DIRECTIVE FOR WHAT EVER ITS TOLD TO EXECUTE
I TRIED CHANGING THE HEX ADDRESSES IN THE SUBROUTINE EVEN THOUGH THEY ARE DIFFERENT IN SAD THAN I CAN SEE IN A HEX EDITOR
AND THEY DO NOT CHANGE THE SUBROUTINE AT ALL

why not just move the maf transfer to the tail end of rom?
WELL I TRIED THAT TODAY AND JUST LIKE ALL THE OTHER THINGS I HAVE MOVED AROUND TO MAKE SPACE FOR THE MAF TRANSFER
IT CAUSES SOME KIND OF UNACCEPTABLE BEHAVIOR
EXAMPLE TODAY MOVING 3038 TO 3518 BECAUSE WHO WANTS AN ADDITIONAL SPARK ADDER I DO NOT !!!
IT LOSES CONTROL OF SPARK AND JUST DOES WHAT EVER IT IS IN THE MOOD TO DO
AS FAR AS THE TAIL END OF ROM ? I WOULD NEED TO KNOW I AM PUTTING IT SOMEWHERE THAT IS NOT CODE
AND SO FAR BY MY AMATEUR DISASSEMBLY I CAN FIND REFERENCES TO FUNCTIONS AND TABLES IN MOST ALL OF THE CODE THAT IS NOT CURRENTLY CLAIMED BY DATA
IS MY DISASSEMBLY CORRECT I AM SURE IT IS NOT TO A PROS STANDARDS IT IS MY FIRST ONE
AND ITS REALLY NOT COMPLETE I AM HAVING TROUBLE GETTING THE DIR TO SEPARATE 1 OR 2 BYTES
SO A LOT OF STUFF I JUST PUT IN MY CMT TO VERIFY ITS LOCATION

2076 isnt a payload, ram is lower addressing so its just 76
U GOT BEAT TO THAT ONE LAST NIGHT I WAS INFORMED SO AGAIN IF I KNEW I WOULD NOT BE ASKING I WOULD KNOW !

you cant move ram unless you have nothing better to do than devote your life to finding every reference and changing it
AGAIN SOMETHING GOOD TO KNOW . I DO NOT NEED TO MOVE RAM I JUST NEED THE FUNCTION I MOVE TO BE ABLE TO ACCESS THE SAME RAM

moving functions does not affect ram addressing.
IF THIS IS INDEED CORRECT FOR A LA3 THEN I AM SIMPLY NOT MOVING FUNCTIONS CORRECTLY
SO I MUST ASK HOW DO I CORRECTLY MOVE FUNCTIONS?
I HAVE TRIED MANY ADDRESS COMBINATIONS AND THE ONLY ONE I FOUND THAT ALMOST WORKED
CAUSED THE FUNCTION TO NOT BE ABLE TO ACCESS THE PAYLOAD IN RAM

OTHER THAN NO IAT DATA IT ACTUALLY WORKED QUITE FINE
BUT I DID USE A BCS ADDRESS THAT EVENTUALLY I WOULD LIKE TO UTILIZE SO NOT MUCH REASON IN MAKING THAT SCENARIO WORK

[decipha]

rassigning functions would be rewriting code to make it do something you want it to

the subroutine is the code

if the hex value is different in sad than in your hex editor you arent at the correct address

you can bet that anything from tbe beginning of rom to the end of used code is all being referenced somewhere

are you finding every reference to that address and moving it? Althought not usually common with spark you will sometimes have nunerous subroutines lookup the same function

if you overwrite the ACT register you could be using a false act value which would cause fuel issues being a critical input

what is a bcs address?

[jeeptech77]

rassigning functions would be rewriting code to make it do something you want it to
OK
the subroutine is the code
OK THANK YOU !
if the hex value is different in sad than in your hex editor you arent at the correct address
THAT SEEMS TO BE THE ISSUE
IN SAD I CAN FIND EVERY ADDRESSE IN THE SUBROUTINES 2 I BELIEVE ARE USED IN MULTIPLE PLACES
HOWEVER IN THE BINARY I HAVE NOT BEEN ABLE TO LOCATE ANY ADDRESSE STRAIGHT FORWARD 3038 OR AND
THIS INCLUDES BEING AWARE IT IS WROTE IN BIG ENDIAN
EXAMPLE 3038 WOULD BE HEX 38 30
you can bet that anything from tbe beginning of rom to the end of used code is all being referenced somewhere

are you finding every reference to that address and moving it? Althought not usually common with spark you will sometimes have nunerous subroutines lookup the same function
NO I AM NOT BEING THAT THE BIN USED IN SAD AND THE DISSEMBLY IN SAD ARE NOT THE SAME I AM UNABLE TO FIND THE CORRECT REFRENCES EVEN THOUGH IN SAD THE CODE MAKES PRETTY GOOD SENSE EXCEPT FOR THE FACT I HAVE TO USE A CHEAT SHEET FOR THE CALLOUTS AND IM NOT 100% SURE EXACTLY WHAT EACH CALLOUT DICTATES I DO UNDERSTAND THE FLOW OF THINGS
AGAIN MY TERMINOLOGY IS MOST LIKELY NOT SPOT ON CODE TALK
if you overwrite the ACT register you could be using a false act value which would cause fuel issues being a critical input
IT IS A DEBATE ON ACT CONTROLLING FUEL OR NOT IT CAN BE UNPLUGGED WITH NO SIDE EFFECTS AND I CAN CHANGE THE FAILED ACT VALUE
STILL HAVING LITTLE TO NO IMPACT ON FUEL
I READ IN A OEM FORD MANUAL THAT ACT IN STOCK CODE ONLY ADDS TIMING WHEN ACT IS LOW
IN LA3 SVO JOHN SET UP ACT TO ADD TIMING / I CHANGED THE STRATEGY SUBSTITUTING THE IAT VS SPARK RETARD FOR ACT VS TEMP FOR SPARK RETARD IT WORKES WELL
what is a bcs address?
BCS IS THE BOOST CONTROL TABLES FUNCTIONS AND SCALERS

I DID TRY 3 OTHER ADDRESSE CONFIGURATIONS TODAY WITH THE SAME OUTCOME
AGAIN AS STATED ABOVE I NOW HAVE COMFIRMATION THAT THE CODE OR SUBROUTINE MUST BE CHANGED

AT THIS POINT I THINK THE CORRECT QUESTION IS WHY DOES THE BIN SEEN IN HEX APPEAR DIFFERENT THAN THE DISSEMBLY ?
IT HAS BEEN SUGGESTED THAT ITS ENCODED SO I TRIED CHANGING HEX ANY WAY AND IT SHOWS NO CHANGES MADE
THANKS FOR YOURE TIME AND ADVICE
JASON DAVIS

[decipha]

if its not the same then you are looking at the wrong address

no such thing as encoded

[jeeptech77]

OK A BIT OF AN UPDATE
I RE EXAMINED THE RAW HEX LOOKING FOR 3038 OR 3830
I DID FIND SEVERAL OF EACH
I ASSUME THAT WHEN I LOOKED BEFORE I HAD TO HAVE LOOKED FOR 1038 NOT ADDING 2K AS THERE IS NO 1038 OR 3810

I THEN WENT THROUGH SAD AND LOOKED FOR 3038 AND 3830, I DID FIND 4 REFRENCES TO 3830 HOWEVER THEY TAKE ME TO
HEX 3830 NOT WHAT I WAS EXPECTING

SO I AM ATTACHING A FEW PICS
ONE IS THE LST IN SAD HEX LINE 435A SPECIFICALLY 0X435B=38 0X435C=30 IN BIG ENDIAN I SEE THE 0X3038
THIS IS THE ONLY INSTANCE OF 3038 I CAN FIND IN LST FOR SAD

THE NEXT PIC IS OF RAW HEX 0X435B AND 0X435C
JUST SHOWING THE BINARY AT WHAT I THINK SHOULD BE THE HEX ADDRESSES LISTED BELOW

IN THE LINE OF 0X435A / 0X435A =A1 0X435B=38 0X435C=30 0X435D=32 LDW = LOAD WORD R? IS UNKNOWN TO ME !
32 SEEMS IT WOULD BE 0X435D = 32 R32=3038;
SO IN THE LINE OF 435A IS THE EXAMPLES I GAVE A REAL HEX EXAMPLE OF WHAT I WOULD SEE FOR A TASK
EXCLUDING THE FACT THAT THE RAW HEX DOES NOT MATCH ?

THE NEXT PICTURE I WILL ATTACH IS WHAT I HAVE FOUND IN SAD FOR 3830
THERE ARE 5 INSTANCES OF 3830 IN THAT BLOCK OF CODE NOT INCLUDING THE HIGHLIGHTED BLUE HEX ADDRESSE OF 3830

ITS CLEAR I AM NOT DOING SOMETHING CORRECT I JUST DONT KNOW WHAT ?
POSSIBLY PROBABLY SEVERAL THINGS
ANY TIPS OR ADVICE OR DIRECTION WOULD BE MUCH APPRECIATED
JASON DAVIS

[jsa]

SAD addresses are for 64kB
Hex editor knows nother of the leading 8kB, so 56kb, add 2000

[jeeptech77]

JSA I NEED A BETTER EXPLANATION THEN THAT PLEASE
ADDING 2000 TO THE BINARY LEADS NO WHERE

0X435A+2000=0X635A
AS YOU WILL SEE IN THE POSTED PIC PER DECIPHA IF IT DOES NOT MATCH UP THEN IM IN THE WRONG PLACE

[jsa]

64k to 56k is 2000 offset
3830 in SAD = 1830 in hex editor

435a in sad = 235a in hex editor

[decipha]

dont take this the wrong way but if you can't line up where your at in hex which is about as simplistic as it gets you probably shouldn't be re-writing code.

Not trying to dissuade you just stating the obvious.

[jeeptech77]

JSA THANK YOU VERY MUCH !

DECIPHA YOU WILL NOT DISSUADE ME LOL