| I got this info from reverse engineering the ECU in my '90 TT... I ran the contents of the ROM chip through a disassembler program, and have spent years analyzing the code and figuring out how the ECU hardware (micro-controller, co-processor, RAM, ROM, sensors, etc...) are mapped within the 64k address space. From this I have developed full 'compilable' assembly source code file, as well as software for editing/compiling the code and generating .bin files for the Hitachi HD6303 micro-controller used in these ECUs ( La-Z-Link ). This source code is effectively identical to what Nissan originally developed, since they hand-coded it all in HD6303 assembly language. The only difference is in the variable/label naming (or lack thereof). I do plan on selling the firmware editor software and source code files for TT, NA and R32 GTR (RB26DETT) eventually... I just want to get a bit of usage out of it first myself ;-)
There is a single subroutine for controlling the A/C relay, the TPS logic starts at 'loc_ADC8'. The TPS actually triggers either a 5 or 7 second countdown timer; it doesn't turn the A/C relay on/off directly.
; A/C relay control
sub_AD4A:
tst byte_00E1
bne loc_AD57
tst byte_15DC
beq loc_AD57
dec byte_15DC loc_AD57:
tim #%1000, ram_Flags5
beq loc_AD5F
jmp loc_AE04
loc_AD5F:
tim #%1000, ram_FlagsA
beq loc_AD7C
tim #%10, ram_Flags1
beq loc_AD7F
ldaa Coolant_Temp2
cmpa byte_F426
bcc loc_AD7C
cmpa byte_F427
bcs loc_ADF3
ldaa byte_FFC0
jmp loc_AE3A
loc_AD7C:
jmp loc_ADF3
loc_AD7F:
ldaa COOLANT_TEMP
tim #8, byte_00C4
beq loc_AD8D
adda #1
bcc loc_AD8D
ldaa #$FF
loc_AD8D:
cmpa byte_F9FE
bcs loc_AD97
oim #8, byte_00C4
bra loc_AD9A
loc_AD97:
aim #$F7, byte_00C4
loc_AD9A:
ldaa COOLANT_TEMP
tim #2, byte_00C4
beq loc_ADA8
adda #3
bcc loc_ADA8
ldaa #$FF loc_ADA8:
cmpa byte_F9ED
bcs loc_ADC5
ldaa VEHICLE_SPEED
tim #2, byte_00C4
beq loc_ADBB
adda #5
bcc loc_ADBB
ldaa #$FF loc_ADBB:
cmpa byte_F9EE
bcs loc_ADC5
oim #2, byte_00C4
bra loc_ADC8
loc_ADC5:
aim #$FD, byte_00C4
loc_ADC8:
tim #%100000, byte_00BE
bne loc_AE04
ldaa ram_TPS
ldab byte_FA0B
tim #$80, byte_00C4
beq loc_ADDD
subb #$14
bcc loc_ADDD
clrb loc_ADDD:
cba
bcs loc_ADFE
tim #$80, byte_00C4
bne loc_ADEE
oim #$80, byte_00C4
ldaa byte_FA0C
staa byte_15DC loc_ADEE:
tst byte_15DC
beq loc_AE04 loc_ADF3:
aim #%11101111, ram_Flags1
ldaa byte_FFC1
nega
staa byte_0087
bra loc_AE21
loc_ADFE:
aim #$7F, byte_00C4
clr byte_15DC
loc_AE04:
tim #$10, ram_Flags1
bne loc_AE25
ldaa byte_0087
bpl loc_AE14
tim #$F, byte_00E1
beq loc_AE15
bra loc_AE19
loc_AE14:
clra
loc_AE15:
deca
bmi loc_AE19
inca loc_AE19:
staa byte_0087
nega
cmpa byte_FFC1
bcs locret_AE44 loc_AE21:
aim #%1111111, ram_Flags7
rts
loc_AE25:
tim #$A, byte_00C4
bne loc_ADF3
ldaa byte_0087
bmi loc_AE35
tim #$F, byte_00E1
beq loc_AE36
bra loc_AE3A
loc_AE35:
clra
loc_AE36:
inca
bpl loc_AE3A
deca loc_AE3A:
staa byte_0087
cmpa byte_FFC0
bcs locret_AE44
oim #%10000000, ram_Flags7 locret_AE44:
rts
; End of function sub_AD4A
|
