EEC V file conversion

[jsa]

I will also post up my results from the previous few tasks that you gave me to learn on. Thanks

Ok.

[BOOSTEDEVERYTHING]

Code: Select all

FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V +4096 :W V +1 P +5      # Mass Air Flow meter transfer function.

ok....Sorry for the delay, This one is defining a function from address 12254 to address 122cb, named "uuwFn036_MAF_Transfer".
it is an unsigned in unsigned out word value as denoted by the uuw in the title.
:=defines structure of a data item
W= as a word data value
V= with a divisor of
+4096= i'm guessing the + means a positive value of 4096
which is dividing the actual values in those columns by 4096 to end up with a human "readable" value
thw second column is about the same but divides the actual value by +1 meaning positive value of 1?
the P +5 i think is to print (display) the value with 5 digits?

[BOOSTEDEVERYTHING]

Code: Select all

STR 16D8A 16DB7 $Q1 :Y :WN                  #
STR 16DB8 16DD0 $Q1 :Y :WN                  #

these define a couple of structures
str= structure
start and end addresses
$= start of a group of global options
Q1= terminator byte with a value of 1---do not completely understand this command
:= start of a new data item
Y= the item is byte sized
W=the item is word sized
N= asks the software to look for and display the name, I think

and I think opcode C3 is STW, which is instructing the computer to store a word sized value, and I think the C3 opcode is a short or long indexed address mode, as C0, C2, & C3 opcodes all seem to be instructing to store word sized values, just in different address modes?

[BOOSTEDEVERYTHING]

I am wondering though, with the dir and cmt files in the same directory it is using them to disassemble the bin file, does that mean that the automatic functions are disabled and it is only disassembling for the commands in the dir file, or is the automatic disassembly still being displayed as it was without those files? I seem to be getting some differences between the raw lst and lst with dir file but not sure if they are all differences that should be present. I attached a screenshot with an example of what I am talking about.

[tvrfan]

Tvrfan here (Andy), writer of SAD. JSA was doing a good job of explaining to you, but I thought I would finally register here and respond.

If you run SAD with no commands at all (i.e. .dir file) SAD will run automatically for everything. I freely accept it doesn't do some things properly (and probably there will always be some weird code or trick by Ford programmers...). If you specify commands, that command becomes 'master' and nothing will supercede it. But everything else will be unaffected and continue automatically.

So if you have a command which specifies say a Function (a 1D lookup) , SAD will not change that command EVEN IF YOUR COMMAND IS WRONG.
I have to do it this way, as user commands need to be able to fix/override any errors.

The example you gave is about what size the function argument is (word or byte). Frankly this is still a bit of a problem to do automatically, as it's not always obvious what the code does with the argument. Arguments are always read as bytes, and then may be used as words depending on the code.
You can override the sizes with ARG command.

BOOSTEDEVERYTHING - the 'Q' is used where you have a structure which has say an 0xff' at the end which is used solely as an 'end' marker. Timer structure is a good example, and also initial setup on some bins. I haven't seen a WORD terminator yet , but the 'Qn' allows for one. All terminators seen so far are a single byte (as you say, a 'Q1')

I am trying to finish an all new version 5 , which will have a big extension to the command sytax, (I am trying to sort out argument sizes), and lots of code has been rewritten to improve it from version 4 and have more user functionality (like proper math calculations). But it's taking much longer than I want.

general note for newbies - 'AA' is a good starter, not because it's mine, but because it's simple, and tiny. It has no subroutines with arguments, so is straightforward. And OLD (1985). The ubiquitous 'A9L' is a lot more complex, has arguments, some self tuning, synced injection, etc... but it's been worked on by many, so comments are mostly good to follow.

[m-barans]

post your file here with information of what you used read (pcm flash, qh , etc...) with and what you want it to be converted to be used on (pcm flash, qh , etc...)and i will convert it for you.

I believe I will require assistance with this. I will be using a Moates QH Tunerpro RT BIN and presumably need a conversion to do a PCM flash thing. Currently waiting on hardware to arrive. I’m willing to pay to. Just a service technician but I do know the more we support each other the easier it is to help each other.

[jsa]

Code: Select all

FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V +4096 :W V +1 P +5      # Mass Air Flow meter transfer function.

ok....Sorry for the delay, This one is defining a function from address 12254 to address 122cb, named "uuwFn036_MAF_Transfer".
it is an unsigned in unsigned out word value as denoted by the uuw in the title.

Yes, but the uuw in the name has no impact on SAD's treatment of the data.

W= as a word data value

Use of UW would command the default Unsigned Word
Use of SW would command Signed Word.

V= with a divisor of
+4096= i'm guessing the + means a positive value of 4096
which is dividing the actual values in those columns by 4096 to end up with a human "readable" value

Yes, however the + is optional these days.
Try 13107.
((2^16)-1)/5=13107

thw second column is about the same but divides the actual value by +1 meaning positive value of 1?

Yes. SAD does not allow the use of enough decimal places to convert counts to kg/hr. SAD V5 should resolve that.

the P +5 i think is to print (display) the value with 5 digits?

Yes it is meant to control print width.

I seem to be getting some differences between the raw lst and lst with dir file but not sure if they are all differences that should be present. I attached a screenshot with an example of what I am talking about.

As TVRfan has explained, the user is king. If the user puts incorrect info in the DIR or CMT, LST will be incorrect. It is important to get commands right.

Raw MSG

Code: Select all

rbase f0 12060 
sub  83212  "UUYFuncLU_83212"   $ F uuyflu 36

DIR'd MSG

Code: Select all

Sub 83212 "SLU83212_UUYFn"    $ F uuyflu 36 :E4 F0 N :WN

DIR'd LST

Code: Select all

0692b: ef,e4,c8           call  83212            SLU83212_UUYFn (
0692e: 88,63                    #arg 1              Func_13a00,
06930: 9d,02                    #arg 2              29d );
06932: 20,09              sjmp  0693d            goto 0693d; }

In the DIR I've posted above, I've added command options to the lookup Subs to instruct SAD how I want those handled.
As TVRfan mentioned SAD does not always get the size of arguments correct.
For the 1st command option;
E4 is Encoding method 4, you can read about it in the SAD docs.
F0 is the Rbase to be used.
N name the address. SAD has a default function name to display.

For the second command option;
W defines the second argument as a Word, not two bYtes as SAD had determined automatically.
N name the address. When register 29D is given a name by using the SYM command, the name will be displayed in place of 29d.

The changes should be present as they have been commanded by the user...but are they correct...to the best of my ability, yes.

[jsa]

Code: Select all

STR 16D8A 16DB7 $Q1 :Y :WN                  #
STR 16DB8 16DD0 $Q1 :Y :WN                  #

these define a couple of structures
str= structure
start and end addresses
$= start of a group of global options

Yes

Q1= terminator byte with a value of 1---do not completely understand this command

The AD command sub loops through the structure, one structure line at a time. There needs to be away to break out of the loop.

Code: Select all

83173: 56,34,00,04        ad3b  R4,R0,[R34]      AD_Cmd = [R34];
83177: de,21              jlt   8319a            if (AD_Cmd >= 0)  {

On every loop AD_Cmd receives a byte from the current address held by R34.
The ad3b operation will set flags depending on the result of adding 3 bytes.
When [R34] retrieves the loop stop value FF, flags will be set indicating a negative value for the addition operation.
FF is a negative value, less than zero, so the uP will jump out of the loop to address 8319a.
You can read about flags and the JLT opcode in the software manual.

:= start of a new data item
Y= the item is byte sized
W=the item is word sized
N= asks the software to look for and display the name, I think

The byte is the analog channel number of the processor internally or external AICE.
The word is where the converted value will be stored. The same address will be read by lookup functions etc.
Yes, display the name.

and I think opcode C3 is STW, which is instructing the computer to store a word sized value, and I think the C3 opcode is a short or long indexed address mode,

Code: Select all

9c04c: c3,01,c8,17,3e     stw   R3e,[R0+17c8]    MAF__A = TMP6L;
9c057: c3,e6,f0,42        stw   R42,[Re6+f0]     MAF = TMP8L;

Two uses of C3, one long and one short indexed.
Note 01 and R0. 01 is odd, hence long indexed, but interpreted as word R0.
E6 is even, hence short indexed.

as C0, C2, & C3 opcodes all seem to be instructing to store word sized values, just in different address modes?

Yes, all the same command with different address modes.

[BOOSTEDEVERYTHING]

Awesome. I think I am getting the commands and how to read what the software is doing. Jsa, your help has been invaluable and means more to me than I can express. And Tvrfan thank you so much for providing the software and support and the help you have also provided. To make it open source like you have is amazing. I am learning a lot. I printed the hardware and software manuals and put them in binders and it helps a lot to be able to flip through them when looking at the files. I am still having trouble interpreting what the actual functions are and how you tell where to find that information. The functions, tables,arguments are labeled in the sad files but how do I know exactly what the function is for? I am trying to cross reference other bins and definition files but it seems that the function numbers are different for different bins.

[jsa]

To give an overview of how I'm approaching disassembly, I'm following the way the BIN runs in effect. Logically how can an output be commanded without inputs to determine the appropriate control response.

First the inputs must be read and converted. Conversion can be by looking up functions, or by math using conversion factors.
Once we have converted units, the units are then further used to look up more functions or tables to determine the required output response.

I've picked on the analog inputs as the starting point.
We've identified the ATOD_LIST which has channel numbers and destination addresses.
If you search LST for _Ch you will see where those destinations are used for various purposes including lookups.

The next step is to identify what the analog channels are being used for. Maybe we'll identify a function as part of that process, maybe it will be deeper in.

I'd use every source of information I can to identify the purpose of scalars, functions, tables and payloads.
That means other disassemblies, strategy documents, definition files, DMR files, logging payloads, plain old head scratching, etc.

Over on openeec there are a number of DMR files. These greatly shortcut the whole process because they are in csv format and can be converted to a DIR commands in excel. Sadly none for REAC4, but don't let that stop us.

I'll be using the RZASA one.
https://github.com/OpenEEC-Project/DMR_ ... SA_DMR.CSV

I've previously converted it to a DIR.

RZASAMY_DIR_16B.zip

(57.88 KiB) Downloaded 53 times

It was done for SAD 4.07.16B, so run it with that version for now.
It quite likely contains errors, from others sources that have been imported.