[Diy_efi] Re: if YOU were bored enough to disassemble...
Brent Prindle
brentp at motobits.com
Wed Aug 28 14:47:04 GMT 2002
I am working on the same controller for the Guzzis and Laverdas. Mostly
trying to interpret the code for the Aprilia right now, which is a
completely different controller. Have it disassembled, need to figure out
what is happening...
If you want some more reference points, I happen to have a few other EPROM
files for Ducati. Let me know if you want them, some may have different
rev-limits since they are from race programmes.
-oo
BrentP at motobits.com
Brent Prindle
----- Original Message -----
From: "Dave Gallant, 12 Point Racing" <dave at 12pointracing.com>
To: <diy_efi at diy-efi.org>
Sent: Tuesday, August 27, 2002 9:30 AM
Subject: Re: [Diy_efi] Re: if YOU were bored enough to disassemble...
> First off - THANKS for poking around in the file! :)
>
>
> >>> I have posted a ZIP file with the BIN, (hopefully) the correct
disassembled
> >>> code, and pics of the ECU for anyone even remotely interested in
poking
> >>> around:
> >>>
> >>> http://www.12pointracing.com/Ducati748Files.zip
> >>
> >> I was curious so I took a look. It looks like there's a code segment
> >> (0x8000 to about 0xd6e0) and a data segment (0xf000-0xffff). Only
about
> >> half of the data segment is used, the bit at the very end is probably a
> >> checksum or version or something like that.
>
> This was my guess as well, as the Ducati 748 and the Ducati 916 share the
> code, all except for the data segment. (The code segment shows variations
as
> well, however slight and mostly offset changes). I have overlaid the maps
of
> the 748 and the 916 (748 revs higher due to shorter stroke - has different
> fuel and timing requirements) to find the offsets of the maps are
identical.
> I have been using this method in search of the holy grail - the rev
limiter
> - looking for singular variations in the data segment that would raise or
> lower the end value. (I am told the highest possible value is 12k due to
> limitations in the code segment).
>
> For more entertainment, here is a Ducati 916 BIN file:
>
> http://www.12pointracing.com/DucatiMaps/Ducati916.bin
>
> >>There's also some kind of
> >> pattern in the code segment from 0xc0c6 to 0xc2c5, it looks like sort
of
> >> test block, it's a regular pattern. Definitely not opcodes.
>
> This segment seems to differ slightly between the 748 and the 916, of
which
> I am not sure why. I am really not sure what this section does.
>
> >> I see three pretty obvious 16x16 tables, altough I'm confused as to why
> >> some of them seem to start on odd byte boundaries.
>
> Interesting enough, I started graphing these on different offsets and
found
> that they were indeed starting on odd offsets. I (not knowing enough other
> than to be dangerous) did not think twice about this. F160 and F162 offer
up
> terribly strange looking graphs, while the offset F161 is a smooth 3D
graph.
> I have graphed the three maps and have links below.
>
> >> I think you said
> >> that this is a n-alpha system so it makes sense that there should be
> >> tables for fuel and spark based on TPS and RPM.
>
> I am sorry, but I do not know what an n-alpha system is? 68HC11 is the
> processor - is this saying the same thing?
>
> >> Table 1 looks a bit
> >> like spark timing and table 2 could be fuel, but I think someone with a
> >> little more experience than me would know for sure. I'll post the
> >> numbers, and I put links to the colorized images of the data segment
and
> >> tables below:
>
> These are good guesses. Here is a bit more background.
>
> There are at least 3 tables within the BIN file. There are two fuel maps,
> and one spark map. There is a "main" fuel map which is for the lower
> (horizontal) cylinder, and a secondary fuel map which is for the upper
> (vertical) cylinder. Exactly how the maps relate to each other (ie: the
> logic) I have no clue, but I do know the two cylinders can be tuned as
> individuals. The third map should be a spark timing advance map, and I
would
> expect to see a range of 0-50+D in final form, with a graph forming a
> plateau graphically no matter what the scale.
>
> In this I should expect to find full advance at around 3-4K RPMs, see it
> hold that until 10K RPM or so, then trail off until 11.4K RPM redline on a
> 748 motor, and the same for a 916 motor except only going until 9K or so.
> Getting a timing light on these motors is difficult at best, but have had
> experience with some of the older solid state ignition modules and found
> they exhibit this behavior exactly. Now the real problem is that the graph
> which I was previously guessing is the main fuel map (number 2) is the
only
> one which would make sense as a base timing map. I will elaborate more
> below.
>
> >> http://www.dessent.net/tmp/data-segment.gif
> >> http://www.dessent.net/tmp/table1.gif
> >> http://www.dessent.net/tmp/table2.gif
> >> http://www.dessent.net/tmp/table3.gif
>
> Great work - I wish I had your tool when I first popped open this BIN
file.
> I have been playing around in it looking at it in HEX. :/
>
> >> table 1, offset 0xf161: (??? x = RPM, y = TPS, z = spark retard ???)
> >> 140 118 96 81 70 61 54 46 34 27 26 25 25 25 23 23
> >> 146 122 97 82 72 63 56 50 38 28 26 26 25 25 23 23
> >> 153 125 100 83 75 65 57 53 42 30 27 26 25 25 23 23
> >> 157 132 104 86 78 67 59 55 44 34 28 26 25 25 23 23
> >> 151 131 107 89 82 71 63 57 47 36 29 26 25 25 23 23
> >> 149 131 112 96 87 75 66 59 50 38 29 26 25 25 23 23
> >> 129 123 112 100 92 82 69 63 52 40 30 26 25 23 23 23
> >> 128 122 112 103 97 87 75 66 58 44 32 26 25 21 20 20
> >> 127 119 112 108 101 94 81 72 60 50 35 29 25 21 18 18
> >> 126 120 115 110 104 96 83 75 63 49 39 30 25 21 17 17
> >> 125 118 111 109 106 97 87 77 66 54 41 31 25 21 17 17
> >> 113 110 107 105 103 97 88 78 65 52 43 32 25 22 19 19
> >> 115 113 112 106 105 102 98 84 72 59 51 39 29 26 20 20
> >> 116 115 113 108 107 102 99 87 66 60 49 40 33 31 25 25
> >> 117 116 114 113 112 109 103 98 76 65 56 48 42 37 32 32
> >> 118 117 115 114 113 111 105 99 77 70 62 56 51 42 33 33
>
>
> This is a pretty distinct fuel curve from my experience with these motors
> (and from what I have gathered from those who "know where the maps are" -
> the series of 19H give it away). There are a few problems with it that
> puzzle me, but more in the display of the 3D graph than with the content
> found within the numbers. The first is that it is backwards. :) In that I
> mean the lowest HEX value is found where I would expect to find the
highest,
> and vice versa. There can be an easy mathmatical conversion taking place,
> however, I have tinkered and found that by increasing the low values to
> obscene values, I indeed richen up the lower end of the RPM range (on the
> sniffer). I can not tell you for which cylinder this first map is for
> however as we have crossover pipes in our exhausts, and without putting a
> probe all the way down to the header I have no way of knowing. Possibly
with
> more time and a decent O2 sensor/sniffer we could determine just what this
> map is.
>
> I created a few 3D views of this particular map:
>
> http://www.12pointracing.com/DucatiMaps/F161H_viewA.gif
> http://www.12pointracing.com/DucatiMaps/F161H_viewB.gif
>
>
> >> table 2, offset 0xf4a0: (??? x = RPM, y = TPS, z = fuel ???)
> >> 90 90 94 100 104 108 110 112 116 122 120 120 100 72 70 70
> >> 90 88 94 100 106 108 110 112 116 122 120 120 100 72 70 70
> >> 86 90 92 96 106 110 110 112 116 122 120 112 96 72 70 70
> >> 86 90 92 96 104 110 110 112 116 122 116 100 92 72 70 70
> >> 92 92 88 94 96 106 108 112 114 120 112 86 92 72 70 70
> >> 88 90 88 90 96 104 104 110 110 112 108 80 84 72 70 70
> >> 88 88 90 86 92 96 96 106 106 108 100 72 76 72 70 70
> >> 82 82 82 78 78 80 88 96 96 100 88 70 64 72 70 70
> >> 76 80 78 74 76 78 80 90 86 90 80 62 56 66 68 70
> >> 72 70 66 72 72 72 70 76 78 80 64 58 50 52 64 70
> >> 68 70 66 68 68 70 70 72 72 74 60 54 48 50 60 70
> >> 66 68 64 64 64 68 70 64 64 62 50 44 44 44 52 60
> >> 46 60 48 56 54 54 54 54 56 58 44 42 40 38 38 50
> >> 16 40 46 52 52 44 46 46 44 44 38 34 32 28 28 30
> >> 10 24 34 40 40 40 40 40 34 32 28 22 24 16 0 0
> >> 4 16 20 30 30 30 30 30 30 28 20 20 20 18 10 10
>
> I honestly do not know what this map is. I once thought it was fuel, but
now
> I am thinking it is possibly the spark map. If you notice that at the
> highest RPM and highest TPS, the timing is actually retarded, which makes
> perfect sense. The graph would support that at WOT (full TPS), but NOT at
> highest RPM is where we are at full advance during acceleration, and this
> maps sense as well. It also exhibits a decent ramp at a low RPM area as to
> allow no advance to get the bike to start, but almost immediately start
> advancing the timing as the TPS and RPMs increase, giving it a good
"bottom
> end feel". The emissions requirements I am sure are coming into play here,
> as the factory is probably attempting to get a cleaning burn at idle
speeds.
> The last hint is that at high RPM with no TPS, there is almost no spark
> advance. I would imagine this would help on/off throttle transitions while
> at speed, even though I did not think of this before and was guessing that
> the "choppy on/off throttle" problem I spoke of before was handled
entirely
> in the fuel map. If this is indeed the spark map, this is an interesting
> solution.
>
> Here are some graphs of this one:
>
> http://www.12pointracing.com/DucatiMaps/F4A0H_viewA.gif
> http://www.12pointracing.com/DucatiMaps/F4A0H_viewB.gif
>
> >> table 3, offset 0xf8ff
> >> 64 56 48 44 36 34 32 32 32 32 32 32 33 32 32 32
> >> 65 57 47 44 36 34 32 32 32 32 32 32 32 32 32 32
> >> 240 208 160 128 80 48 36 32 32 32 32 32 32 32 32 32
> >> 224 192 145 96 64 48 36 32 32 32 32 32 32 32 32 32
> >> 177 141 96 64 48 40 36 33 33 32 32 32 32 32 32 32
> >> 120 96 64 48 43 37 34 33 33 32 32 32 32 32 32 32
> >> 74 58 48 44 40 36 34 33 33 32 32 32 32 32 32 32
> >> 68 54 48 40 38 34 34 33 33 32 32 32 32 32 32 32
> >> 55 49 43 39 36 34 33 33 33 32 32 32 32 32 32 32
> >> 48 44 42 38 36 33 33 33 33 32 32 32 32 32 32 32
> >> 40 38 36 36 36 33 33 33 33 32 32 32 32 32 32 32
> >> 40 38 35 35 33 33 33 33 32 32 32 32 32 32 32 32
> >> 40 36 34 33 33 33 33 33 32 32 32 32 32 32 32 32
> >> 40 38 36 35 34 33 33 33 33 32 32 32 32 32 32 32
> >> 40 38 36 36 35 33 33 33 32 32 32 32 32 32 32 32
> >> 40 36 34 34 34 33 33 32 32 32 32 32 32 32 32 32
>
> And with this map, I can't even wager an educated guess. Possibly this is
a
> correction map of some sort...Overall, I am missing the location of the
> secondary fuel map, however my first guess would be this is a timing
> adjustment map for the coolant temperature sensor. (I am told timing is
> pulled out as the bike's coolant gets hotter and hotter, and it is not
> linear. I would LOVE to kill this calibration factor at some point). Of
> course, this is just a guess, and it quite possibly could be some strange
> correction map for the secondary fuel map. This is where having a CLUE as
to
> what the code was doing would be worth its weight in gold. :/
>
> Keep the thoughts coming - it has only taken you guys 1 day to get as far
as
> I have gotten in 1 month. :)
>
> d-
>
> ----------------------
> dave at 12pointracing.com
> MRA #31, AMA #232
>
>
>
>
> _______________________________________________
> Diy_efi mailing list
> Diy_efi at diy-efi.org
> http://www.diy-efi.org/mailman/listinfo/diy_efi
>
_______________________________________________
Diy_efi mailing list
Diy_efi at diy-efi.org
http://www.diy-efi.org/mailman/listinfo/diy_efi
More information about the Diy_efi
mailing list