93 Z disassembly - I have jsrs to non prom location.

[Roger Heflin]

On Thu, 14 Jan 1999, Mike wrote:

> >Hey,
> >
> >I have finished the TCC control routine, and I think I understand
> >all of it, except how the TCC actually gets triggered.  
> 
> I wrote to the list on Dec. 21, 1998:
> 
> >>Try looking at the logic starting at D1C9. I suspect the TCC is controlled
> here >>though I've never seen a PWM output at $4008 :)
> 
> Did you look there yet? That's where I think it is.
>

I did look there.  I am going to have to examine it closer, and more
carefully.   The TCC is bothering me less since I believe one way or
the other if the right bit of $0066 is set that the TCC will somehow
lock itself.   I have figured out how the injectors are controlled (at
least at the HW level, and timer level).  I am still working on
exaclty how it calculated the required pulsewidth.

 > >There aren't
> >any things checking the TCC bit and setting a register in the $1000
> >range.   I did find some odd code that does jsr into the $5000 range,
> >the prom is mapped from $8000-$FFFF, so $5000 would have to be
> >built into the computer's internals.    
> 
> Not necessarily. Look on the ECM board and you'll see a 60-pin edge
> connector. Likely GM attaches equipment to this port and maps code hooks in
> the $5xxx range for testing and development etc. Closely examine the section
> of code that looks at $5000 (among others) and compares the 16-bit value
> there to #$7E5x. Then look in your code for opcode '7E' and you'll see it's
> a JMP. The ECM checks for the presence of something attached there by
> examining the program code there. If it seems valid (JMP $5800 for example),
> the ECM enables the hooks. This is what I gather at least. I might be wrong.
> 
> Look around DC3E in your code, Roger, to see where the ECM checks to see if
> there's something valid at the $5xxx range.

That actaully tells me alot.  I will look at the code with these ideas
in mine.

> 
> >There about 10 of these jsrs
> >to different addresses in the $5000 range.  Does anyone have any
> >idea what these do?   If I really want to know bad, I will setup
> >a prom to read that range (while petting the watchdog), and output
> >that data to the aldl port.  I am thinking some of the hardware
> >operations (TCC and several others maybe) are being done there.
> >
> 
> No normal hardware operations are done in these routines. They are strictly
> GM development and test areas.
> 
> In most P4-style ECMs, you'll find the outputs controlled by accessing the
> $3xxx registers and some registers in the $4xxx range. Some odd animals like
> yours that actually have stuff mapped to $1xxx don't automatically use them
> for discrete control. In the case of your TCC, I think you'll see $4008 is
> the control output and they send either 100% duty to turn it on or 0% duty
> to turn it off.
> 
> If you do write a PROM, try emulating the essential code at D1C9 and have it
> toggle the value written to $4008 and then look at the TCC output for
> activity. Don't forget to include lots of COP resets all over the place.
> 

YOu would not want to make the watchdog happy.  It might bite.

Thanks.

				Roger