ECU Firmware

        Well here is the center of the universe as far any EFI system is concerned.  This code is written in all 68HC11 assembler so at least it doesn't have all the useless baggage that compiled code has.  It is not with out its own problems though.  The code is split into two major parts.  The first contains all the Algorithms and the functional code and the second part contains all of the Calibration constants.  The code looks to be highly leveraged from some already existing application.  The reason I say that is the number of sections that have absolutely no function and others that can never be called.  My guess is that Weber started with some production code set and modified it to work with the PRO-FLO EFI.  Also the way it is structured with all the Calibration constants at the end it looks to me that when the code was handed to Edelbrock support the only access they have is to the Calibration portion.  I've dis-assembled several versions of (different part numbers) their ROMs and the only difference between any of them is in the Calibration section.  This brings up an interesting point.  If a problem exists in the main body of the code Edelbrock does not have access to the original source code to fix it.
        It was not a trivial task to comment and some what understand to flow of this code set.  There is a good 4 months of solid work to get it to a point where I could make sense out of what is going on.  There are still areas that are not clear.  One of the biggest difficulties was working around the mistakes in the code.  You go into something like this assuming the has been thoroughly tested and debugged so when you find something that does not make sense you assume that is some lack of understanding on your part rather than something wrong with the code.  Well that wasn't the case here.  There is so much hacking going around in the code that it was very difficult trying to figure what was being used and what was mistake.  This all stems from using a code set from some other application and chopping it up for some other application.  It does work well from a general user's stand point but when you get farther into it it isn't pretty sight.  How I attacked the problem of commenting it was first to dis-assemble the controller's code.  This gave me the serial protocol and some of the memory locations used in the ECU for the items that were reported to the controller.  Also I could figure the out the values and range of each of these memory locations.  I also took numerous scope and voltage readings. Looking at the ignition signals going to and from the ECU gave me the active edge of the ignition trigger and also the firing edge of the ignition amplifier.  I characterized the MAT and Coolant temperature sensors (resistance vs temp) and the output of the MAP sensor.  Armed with this information made it a little easier to apply meaning to the some of the internal values by code.  As I stated earlier mistakes made this task much more daunting.  To give you a flavor you can check the Mistake Log.  Most are trivial, some just poor programing, some just inefficient, and a few just plain broken.
        I had a hard time finding good tools for doing what I needed here.  Everything from assemblers to dissemblers to simulators was lacking in one way or the other.  You can check out Tools page for more information on some of the programs I wrote for working with this code and understanding how it works.

These are Edelbrock Part Numbers verses Cam Specs:
 

Edelbrock PN Cam Timing Specs
3511 Stock thru 207 deg @ .050"
3512/3522 208 thru 220 deg @ .050"
3513/3523 221 thru 230 deg @ .050"
3514 231 thru 240 deg @ .050"
3515 ZZ3 Roller (208 deg)
3516 241 thru 246 deg @ .050"

        Notice that for some part numbers there is a replacement series.  I have only had access to a couple different EPROMs.  One major difference between the early series (351x) and the latter current series (352x) EPROMs is the forced maximum MAT temperature with the throttle plates closed.  I believe this is an attempt to correct the 'blower roll' problem.  More on this subject later.  The 3512/3522 pair there is also quite a bit of difference in the Spark and Fuel maps along with some idle parameters.  If any one can fill in the gaps it would be appreciated.  Obviously the most work has been done on the 3516 series EPROM that I am currently running.

Following are some of the basic measurements that where taken during the initial phases:

Here is some information on the Sensors and Transfer functions feeding the ECU. This stuff is all documented in the code but I broke some of it out here for the curious. Here are some different Maps that have been pulled from various code sets. 10/25/1999 -
    Here are some flow charts of the major subroutines and processes.   These are of unmodified original code and up to my current understanding as of this date.  Broken areas and section that are not used at all are included in these flow charts so be wary.  They were a bit tedious to make so there may be some typo's (hope not, but if you catch something please let me know.  The pdf versions are not the best but should be useable.  The graphical pages are slightly more wordy so check them also.
Key On Entry    (pdf version)
Main Calibration Loop    (pdf version)
    Closed Loop Fuel Calculation Subroutine    (pdf version)
    Idle Air Control and Dashpot Subroutine    (pdf version)
Distributor Trigger Interrupt Handler    (pdf version)
Timer Overflow Interrupt Handler    (pdf version)
Ignition Amp (SA) Driver Interrupt Handler    (pdf version)
IAC Motor Interrupt Handler    (pdf version)
SCI Serial Interrupt Handler    (pdf version)

01/12/2000 -
     I have learned a little more about the relationship between the SA interrupt handler and the Distributor Trigger interrupt handler as I was working on the crank trigger stuff.  These two interrupts are allowed to be nested to assure that the plug gets fired and the proper dead time is calculated.  There is a little more information at the below link.


      Well I guess if you are still curious and up for a challenge it is about time to look at the code.  Unfortunately there isn't a clean break between when I was trying to figure out how it worked and when I started modifying things.  I have backed out the changes I made (mostly by conditional assembly) so what is presented here when assembled will be an exact copy of the binary in my original  #3516 EPROM.  One down side here is as I continued to work with and modify the code I learned more so some of the comments and RAM locations/functions may not be entirely correct.  Keep that in mind.  Also I would appreciate it if you can add some understanding to some of the gray areas that you would let me know so I can update the master source code.  As far as assembling is concerned this code will assemble with my assembler.  Its 11,000 lines and 400k girth may choke other assemblers (like AS11 which sometimes stops dead in its tracks) which may just go out into space.  So if you want to use another assembler do so at your own risk (mine works and it is free).

09/04/1999 -
    I have brought this version a little more up to date.  I was able to get a little more information on some of the internal tables and constants.  I updated this version with those comments.  Some interesting stuff.  Like the A/C idle speed control, more information on high altitude compensation and some auto adaptive statements (haven't figured them out yet).  This will probably the last time I revisit this piece of code unless I find something of major interest.