[Diy_efi] Re: if YOU were bored enough to disassemble...
Dave Gallant, 12 Point Racing
dave at 12pointracing.com
Tue Aug 27 18:43:51 GMT 2002
First off - THANKS for poking around in the file! :)
>>> I have posted a ZIP file with the BIN, (hopefully) the correct disassembled
>>> code, and pics of the ECU for anyone even remotely interested in poking
>>> around:
>>>
>>> http://www.12pointracing.com/Ducati748Files.zip
>>
>> I was curious so I took a look. It looks like there's a code segment
>> (0x8000 to about 0xd6e0) and a data segment (0xf000-0xffff). Only about
>> half of the data segment is used, the bit at the very end is probably a
>> checksum or version or something like that.
This was my guess as well, as the Ducati 748 and the Ducati 916 share the
code, all except for the data segment. (The code segment shows variations as
well, however slight and mostly offset changes). I have overlaid the maps of
the 748 and the 916 (748 revs higher due to shorter stroke - has different
fuel and timing requirements) to find the offsets of the maps are identical.
I have been using this method in search of the holy grail - the rev limiter
- looking for singular variations in the data segment that would raise or
lower the end value. (I am told the highest possible value is 12k due to
limitations in the code segment).
For more entertainment, here is a Ducati 916 BIN file:
http://www.12pointracing.com/DucatiMaps/Ducati916.bin
>>There's also some kind of
>> pattern in the code segment from 0xc0c6 to 0xc2c5, it looks like sort of
>> test block, it's a regular pattern. Definitely not opcodes.
This segment seems to differ slightly between the 748 and the 916, of which
I am not sure why. I am really not sure what this section does.
>> I see three pretty obvious 16x16 tables, altough I'm confused as to why
>> some of them seem to start on odd byte boundaries.
Interesting enough, I started graphing these on different offsets and found
that they were indeed starting on odd offsets. I (not knowing enough other
than to be dangerous) did not think twice about this. F160 and F162 offer up
terribly strange looking graphs, while the offset F161 is a smooth 3D graph.
I have graphed the three maps and have links below.
>> I think you said
>> that this is a n-alpha system so it makes sense that there should be
>> tables for fuel and spark based on TPS and RPM.
I am sorry, but I do not know what an n-alpha system is? 68HC11 is the
processor - is this saying the same thing?
>> Table 1 looks a bit
>> like spark timing and table 2 could be fuel, but I think someone with a
>> little more experience than me would know for sure. I'll post the
>> numbers, and I put links to the colorized images of the data segment and
>> tables below:
These are good guesses. Here is a bit more background.
There are at least 3 tables within the BIN file. There are two fuel maps,
and one spark map. There is a "main" fuel map which is for the lower
(horizontal) cylinder, and a secondary fuel map which is for the upper
(vertical) cylinder. Exactly how the maps relate to each other (ie: the
logic) I have no clue, but I do know the two cylinders can be tuned as
individuals. The third map should be a spark timing advance map, and I would
expect to see a range of 0-50+D in final form, with a graph forming a
plateau graphically no matter what the scale.
In this I should expect to find full advance at around 3-4K RPMs, see it
hold that until 10K RPM or so, then trail off until 11.4K RPM redline on a
748 motor, and the same for a 916 motor except only going until 9K or so.
Getting a timing light on these motors is difficult at best, but have had
experience with some of the older solid state ignition modules and found
they exhibit this behavior exactly. Now the real problem is that the graph
which I was previously guessing is the main fuel map (number 2) is the only
one which would make sense as a base timing map. I will elaborate more
below.
>> http://www.dessent.net/tmp/data-segment.gif
>> http://www.dessent.net/tmp/table1.gif
>> http://www.dessent.net/tmp/table2.gif
>> http://www.dessent.net/tmp/table3.gif
Great work - I wish I had your tool when I first popped open this BIN file.
I have been playing around in it looking at it in HEX. :/
>> table 1, offset 0xf161: (??? x = RPM, y = TPS, z = spark retard ???)
>> 140 118 96 81 70 61 54 46 34 27 26 25 25 25 23 23
>> 146 122 97 82 72 63 56 50 38 28 26 26 25 25 23 23
>> 153 125 100 83 75 65 57 53 42 30 27 26 25 25 23 23
>> 157 132 104 86 78 67 59 55 44 34 28 26 25 25 23 23
>> 151 131 107 89 82 71 63 57 47 36 29 26 25 25 23 23
>> 149 131 112 96 87 75 66 59 50 38 29 26 25 25 23 23
>> 129 123 112 100 92 82 69 63 52 40 30 26 25 23 23 23
>> 128 122 112 103 97 87 75 66 58 44 32 26 25 21 20 20
>> 127 119 112 108 101 94 81 72 60 50 35 29 25 21 18 18
>> 126 120 115 110 104 96 83 75 63 49 39 30 25 21 17 17
>> 125 118 111 109 106 97 87 77 66 54 41 31 25 21 17 17
>> 113 110 107 105 103 97 88 78 65 52 43 32 25 22 19 19
>> 115 113 112 106 105 102 98 84 72 59 51 39 29 26 20 20
>> 116 115 113 108 107 102 99 87 66 60 49 40 33 31 25 25
>> 117 116 114 113 112 109 103 98 76 65 56 48 42 37 32 32
>> 118 117 115 114 113 111 105 99 77 70 62 56 51 42 33 33
This is a pretty distinct fuel curve from my experience with these motors
(and from what I have gathered from those who "know where the maps are" -
the series of 19H give it away). There are a few problems with it that
puzzle me, but more in the display of the 3D graph than with the content
found within the numbers. The first is that it is backwards. :) In that I
mean the lowest HEX value is found where I would expect to find the highest,
and vice versa. There can be an easy mathmatical conversion taking place,
however, I have tinkered and found that by increasing the low values to
obscene values, I indeed richen up the lower end of the RPM range (on the
sniffer). I can not tell you for which cylinder this first map is for
however as we have crossover pipes in our exhausts, and without putting a
probe all the way down to the header I have no way of knowing. Possibly with
more time and a decent O2 sensor/sniffer we could determine just what this
map is.
I created a few 3D views of this particular map:
http://www.12pointracing.com/DucatiMaps/F161H_viewA.gif
http://www.12pointracing.com/DucatiMaps/F161H_viewB.gif
>> table 2, offset 0xf4a0: (??? x = RPM, y = TPS, z = fuel ???)
>> 90 90 94 100 104 108 110 112 116 122 120 120 100 72 70 70
>> 90 88 94 100 106 108 110 112 116 122 120 120 100 72 70 70
>> 86 90 92 96 106 110 110 112 116 122 120 112 96 72 70 70
>> 86 90 92 96 104 110 110 112 116 122 116 100 92 72 70 70
>> 92 92 88 94 96 106 108 112 114 120 112 86 92 72 70 70
>> 88 90 88 90 96 104 104 110 110 112 108 80 84 72 70 70
>> 88 88 90 86 92 96 96 106 106 108 100 72 76 72 70 70
>> 82 82 82 78 78 80 88 96 96 100 88 70 64 72 70 70
>> 76 80 78 74 76 78 80 90 86 90 80 62 56 66 68 70
>> 72 70 66 72 72 72 70 76 78 80 64 58 50 52 64 70
>> 68 70 66 68 68 70 70 72 72 74 60 54 48 50 60 70
>> 66 68 64 64 64 68 70 64 64 62 50 44 44 44 52 60
>> 46 60 48 56 54 54 54 54 56 58 44 42 40 38 38 50
>> 16 40 46 52 52 44 46 46 44 44 38 34 32 28 28 30
>> 10 24 34 40 40 40 40 40 34 32 28 22 24 16 0 0
>> 4 16 20 30 30 30 30 30 30 28 20 20 20 18 10 10
I honestly do not know what this map is. I once thought it was fuel, but now
I am thinking it is possibly the spark map. If you notice that at the
highest RPM and highest TPS, the timing is actually retarded, which makes
perfect sense. The graph would support that at WOT (full TPS), but NOT at
highest RPM is where we are at full advance during acceleration, and this
maps sense as well. It also exhibits a decent ramp at a low RPM area as to
allow no advance to get the bike to start, but almost immediately start
advancing the timing as the TPS and RPMs increase, giving it a good "bottom
end feel". The emissions requirements I am sure are coming into play here,
as the factory is probably attempting to get a cleaning burn at idle speeds.
The last hint is that at high RPM with no TPS, there is almost no spark
advance. I would imagine this would help on/off throttle transitions while
at speed, even though I did not think of this before and was guessing that
the "choppy on/off throttle" problem I spoke of before was handled entirely
in the fuel map. If this is indeed the spark map, this is an interesting
solution.
Here are some graphs of this one:
http://www.12pointracing.com/DucatiMaps/F4A0H_viewA.gif
http://www.12pointracing.com/DucatiMaps/F4A0H_viewB.gif
>> table 3, offset 0xf8ff
>> 64 56 48 44 36 34 32 32 32 32 32 32 33 32 32 32
>> 65 57 47 44 36 34 32 32 32 32 32 32 32 32 32 32
>> 240 208 160 128 80 48 36 32 32 32 32 32 32 32 32 32
>> 224 192 145 96 64 48 36 32 32 32 32 32 32 32 32 32
>> 177 141 96 64 48 40 36 33 33 32 32 32 32 32 32 32
>> 120 96 64 48 43 37 34 33 33 32 32 32 32 32 32 32
>> 74 58 48 44 40 36 34 33 33 32 32 32 32 32 32 32
>> 68 54 48 40 38 34 34 33 33 32 32 32 32 32 32 32
>> 55 49 43 39 36 34 33 33 33 32 32 32 32 32 32 32
>> 48 44 42 38 36 33 33 33 33 32 32 32 32 32 32 32
>> 40 38 36 36 36 33 33 33 33 32 32 32 32 32 32 32
>> 40 38 35 35 33 33 33 33 32 32 32 32 32 32 32 32
>> 40 36 34 33 33 33 33 33 32 32 32 32 32 32 32 32
>> 40 38 36 35 34 33 33 33 33 32 32 32 32 32 32 32
>> 40 38 36 36 35 33 33 33 32 32 32 32 32 32 32 32
>> 40 36 34 34 34 33 33 32 32 32 32 32 32 32 32 32
And with this map, I can't even wager an educated guess. Possibly this is a
correction map of some sort...Overall, I am missing the location of the
secondary fuel map, however my first guess would be this is a timing
adjustment map for the coolant temperature sensor. (I am told timing is
pulled out as the bike's coolant gets hotter and hotter, and it is not
linear. I would LOVE to kill this calibration factor at some point). Of
course, this is just a guess, and it quite possibly could be some strange
correction map for the secondary fuel map. This is where having a CLUE as to
what the code was doing would be worth its weight in gold. :/
Keep the thoughts coming - it has only taken you guys 1 day to get as far as
I have gotten in 1 month. :)
d-
----------------------
dave at 12pointracing.com
MRA #31, AMA #232
_______________________________________________
Diy_efi mailing list
Diy_efi at diy-efi.org
http://www.diy-efi.org/mailman/listinfo/diy_efi
More information about the Diy_efi
mailing list