DESCRIPTION AND OPERATION

PURPOSE AND SCOPE

This manual describes the software of the 1997 Viper SR powertrain control module (PCM). It covers the 8.0L V10 engine and the JTEC controller. The PCM is a digital computer containing a microprocessor, mounted underhood next to the heater motor blower housing (Fig. 1). It reads its inputs, makes its control decisions, and operates its outputs as described in the service manual. This manual explains the program that makes those decisions.

Every statement in this manual is taken from one reference image, the 256 KiB flash image VIP_2A03.ori, with calibration 04848703AF. The image is identified in 0-2 Reference Image Identification. The processor is a Motorola 68HC16. The image occupies CPU addresses 000000 through 03FFFF. Where this manual describes vehicle wiring, connectors, or component operation, it follows the 1997 Dodge Viper Service Manual and identifies the service manual group.

The manual describes what the software does with its inputs, flags, requests, tables and output commands. It does not replace the service manual for vehicle-side diagnosis and repair.

HOW THIS MANUAL IS ORGANIZED

The manual is divided into groups in the same way as the service manual. Group 0 introduces the manual, identifies the reference image, and defines terms (0-3 Glossary). Group 1 describes how the program starts, schedules its work and handles interrupts (1-2 Startup and Initialization, 1-3 Job Scheduling, 1-4 Interrupts). Groups 2 through 8 describe individual systems: engine events, fuel, ignition, outputs, speed and transmission, sensor fault handling, and on-board diagnostics.

Each system section is arranged in the service manual order:

A table of the calibration structures used by the section closes each system section. Group 9 holds the calibration data: the flash structure of the complete image (9-1 Flash Structure) and every calibration table, curve, setting and record, grouped by system. Group 10 is the reference group. It holds the PCM connector pinouts (10-1 PCM Connector Pinouts), the work schedule tables (10-2 Work Schedule Tables), the routine index (10-3 Routine Index) and the alphabetical index (10-4 Alphabetical Index).

ROUTINE, RAM AND ROM ADDRESSES

A routine is named by the six-digit hexadecimal address of its first instruction, for example the A/C clutch control routine 018588. Each routine address in the text is a link to its entry in the routine index, which gives the routine name and every section that refers to it. Section 5-2 Accessory and Evaporative Outputs describes this routine in full.

Working values are held in RAM at addresses F8000 and above. At reset, the initialization routine (020000) selects bank F and loads the Z index register with 8000 (Fig. 2). Instructions written as an offset from Z therefore address F8000 plus the offset: LDAA 0x5a,Z reads F805A. The manual always gives the full five-digit RAM address.

020000LDAB  #0xf; bank F020002TBZK  ; Z bank02000ALDZ   #0x8000; Z = F8000

RAM from F8000 through F87FF is cleared at every reset. RAM from F8800 upward holds retained values. The reset routine preserves them when their stored check sum matches, and seeds default values when it does not (1-2 Startup and Initialization).

A single bit is written with its mask value in hexadecimal. "F8107, bit 20" is the bit tested and set by #0x20 in the byte at F8107.

Calibration values are read from ROM by their four-digit address, for example 3D65. In a listing a ROM operand is written without an index register: CMPA 0x3d65 compares the accumulator with the calibration byte at 3D65 (Fig. 3). Each calibration value printed in this manual is read from the reference image when the manual is built, and its raw value is shown when the pointer rests on it.

0186DALDAA  0x5a,Z; RAM F805A, engine speed0186F0CMPA  0x3d65; ROM 3D650186F6BSET  0x674,Z,#0x20; RAM F8674, bit 200186FCLDAA  0xa6,Z; RAM F80A6, coolant018712CMPA  0x3d67; ROM 3D67018718BSET  0x674,Z,#0x10; RAM F8674, bit 10

FIGURES AND FLOWCHARTS

Figures are numbered within each section. Four kinds of figure are used:

• Flowcharts show the order of decisions in a function. Shaded cards mark the request, flag or command that the function produces. A card that carries a routine address links to that routine.
• Listings reproduce the decisive instructions of a routine from the reference image, with the instruction address at the left and a comment at the right. Readable C listings show the same logic in C. Each one is checked against the original instructions.
• Calibration figures draw a table as a heat map or a curve, with its ROM address and the routine that reads it. Each one links to its complete entry in Group 9.
• Service manual figures are reproduced from the 1997 Dodge Viper Service Manual. The caption gives the service manual group.

The three kinds of reference meet in each system section (Fig. 4). A routine reads RAM signals and ROM calibration and produces a request. An output command carries the request to a PCM circuit, and the service manual figure shows that circuit in the vehicle.

REVISIONS

This manual is revised as more of the PCM software is documented in readable C. Sections gain listings, flowcharts and calibration figures with each revision. Every revision is built from the same reference image. The build checks the image, every routine address, every listing address and every printed calibration value, so a page that disagrees with the image is not published.

SPECIFICATIONS

CONVERSIONS

The PCM stores values as raw counts. The manual prints them in physical units with the conversions below. A value with no conversion is printed in hexadecimal.

ADDRESS RANGES

DESCRIPTION AND OPERATION

REFERENCE IMAGE

This manual describes one PCM program: the reference image VIP_2A03, a 262,144-byte (256 KiB) copy of the main processor flash memory. Every routine address, table address and calibration value in this manual is an offset into that image. The build of this manual checks the SHA-256 hash of the image before it reads any value, so every figure and specification is taken from the same bytes. Refer to Specifications.

The PCM is a digital computer containing a microprocessor (Fig. 1). In this image the main processor is a Motorola CPU16-family (68HC16) device. The program uses the CPU16 20-bit address space: the bank registers extend 16-bit addresses, program code runs in banks 0 through 2, and RAM and the on-chip modules sit in bank F. The serial communications interface (SCI) status and data registers, for example, are read and written at FFC0C and FFC0E.

CALIBRATION IDENTIFICATION

The image carries calibration number 04848703AF. The long word at 000200 points to the identifier at 002738. The identifier is seven bytes: four bytes of packed BCD (0484 8703), the ASCII revision letters 41 and 46 ("AF") and a final byte A0. A second copy of the same seven bytes begins at 00273F (Fig. 3).

Chrysler's scan-tool flash catalog lists 04848703AF for the 1997 SR 8.0L BUX application (Built Up Export, the export Viper). It supersedes calibrations 04848703AA, AB, AC, AD and AE and is released under TSB 18-24-98. The domestic 1997 application carries a different calibration number (04848702).

The PCM reports its identification through the SCI diagnostic service (00C800). Request 2A selects the identification lookup at 00DF22. The request carries a one-based index from 1 to 31 (01–1F). The bound test is a signed compare, so indexes 81 to FF are also answered: they read address words beyond the end of the list and return other bytes of the image. Index 00 and indexes 20 to 80 send nothing. The routine selects one of two address lists by the state byte F835A, which startup reads from logical EEPROM location 1EF: the list at F741 when the byte holds 55, otherwise the list at F703. It loads the indexed address, reads that byte of the image and sends it with the SCI transmit routine (00EBC0), which waits for the transmitter-empty flag before it writes the data register (Fig. 2). The leading entries of the F703 list address the first identifier copy; those of the F741 list address the second. Both lists also address calibration bytes 3F1E–3F2E and the bytes 2746–274B (8-7 Scan Tool Commands).

00DF22CLRB  00DF24TBXK  00DF26LDAB  0x346,Z; requested index00DF2ALBEQ  0x00ebd6; zero: finish00DF2EDECB  00DF30CMPB  #0x1f; index limit00DF32LBGE  0x00ebd600DF36LDAA  0x35a,Z; list select state00DF3ACMPA  #0x5500DF3CBEQ   0x00df4800DF3ELDX   #0xf703; first list00DF42ABX   00DF44ABX   00DF46BRA   0x00df5000DF48LDX   #0xf741; second list00DF4CABX   00DF4EABX   00DF50LDX   0x0,X; address from list00DF52LDAB  0x0,X; identification byte00DF54JSR   0x00ebc0; transmit00DF58JMP   0x00ebd6

ENGINE PROFILE SELECTION

The image holds engine profiles for several engine configurations. The calibration selects one of them at startup. The reset initialization routine (020000) reads the engine profile selector at 002707 and compares it with eight single-bit values. In this image the selector is 02, and the branch at 0204CA selects the V10 profile at 0006CA and the output-mask table at 0008BA (Fig. 5). The routine stores both pointers in RAM (F8058 and F8177). Engine routines read the profile through the stored pointer from then on, so no other profile takes part in operation. Refer to 1-2 Startup and Initialization.

The selected profile records a cylinder count of 10 at 0006CB and again at 000702. The firing-order sequence at 0006E4 lists cylinders zero-based. Adding one to each entry gives 1-10-9-4-3-6-5-8-7-2, the firing order of the 8.0L V10 engine (Fig. 6). Two more copies follow at 0006EE and 0006F8, each rotated one position further. The cylinder-indexed accumulator routine (0119EE) reads the copy at 0006F8 through the profile pointer, selected by profile byte 0006D3 (02), and the engine event interrupt (028F24) uses the cylinder count to form its cylinder-position index. The output-mask table holds ten distinct single-bit masks. The fuel pulse-width routine (0109DC) and the startup fuel routine (011B14) read it through the stored mask pointer. Refer to 2-1 Engine Position and Timing.

020436LDAA  0x2707; engine selector020442CMPA  #0x80020444BNE   0x02045a02045ACMPA  #0x40020472CMPA  #0x20020488CMPA  #0x1002049ECMPA  #0x80204B4CMPA  #0x40204CACMPA  #0x2; V10 selector0204CCBNE   0x0204e00204CELDX   #0x6ca; V10 profile0204D2LDY   #0x8ba; output masks0204DEBRA   0x0204f40204F4STX   0x58,Z; profile pointer0204F8STY   0x177,Z; mask pointer

MEMORY MAP

The image begins with the CPU16 reset vector. Its four words set the initial bank registers, program counter, stack pointer and IZ register. The program counter word 0000 with program bank 1 starts execution at 010000, the first entry of a 27-entry jump table, which jumps to the reset initialization routine at 020000. The 252 interrupt vector words from 000008 to 0001FF follow. All but one point to short jump stubs in bank 0; vectors without a handler point to the default fault stub 00081E, which jumps to the default trap entry 02194A. The SCI vector (4E, at 00009C) points directly to the SCI transmit interrupt routine (00EC5A). The vector table is drawn in 1-4, Fig. 2; refer to 1-4 Interrupts.

Calibration and configuration data occupy the low 64 KiB, separated by FF fill. The principal calibration area runs from 002600 to 003F9F and holds the engine selector and the identifier. The SCI diagnostic service and its protocol tables sit between 00C800 and 00FC01. The main program begins at 010000 and ends at 02A00F; a copyright record follows, and FF fill runs from 02A02A to the end of the image. The table below lists the principal regions. Refer to 9-1 Flash Structure for the block-by-block map.

SPECIFICATIONS

The calibration number is four bytes of packed BCD followed by two ASCII letters. Application and bulletin are from Chrysler's scan-tool flash catalog.

TERMS

Active fallback flag

Working state that helps select a substitute input now. It can clear while a trouble code remains stored.

Calibration / map

Saved numbers or tables used to make control decisions, such as a starting fuel amount.

Cylinder bank

One group of cylinders on one side of a V-shaped engine.

Cylinder bank

One of the engine’s two cylinder groups. Bank-specific codes distinguish the group being monitored.

ECU / PCM

The engine computer. PCM is Chrysler's name for the powertrain control module.

Evaporative purge

Control associated with moving stored fuel vapors into the engine.

Fault trap

A path for an unexpected processor condition. These handlers do not return to the normal work in this image.

Flag

A small saved yes/no state, such as whether a calculation is requested.

Fuel trim

A fuel correction made using feedback. Short-term correction reacts to recent readings; long-term correction remembers an adjustment over time.

Fuel-inhibit mask

A set of selection bits that can tell the fuel calculation to hold back a prepared pulse for particular logical cylinders. Why each bit is set still needs tracing.

Held reading

A previous working value kept while the current sample is rejected. It can be stale.

Immediate-invalid flag

A software note that a local input check rejected a sample. The complete fault-code policy is a separate process.

Input capture

Hardware that remembers the timer value when an electrical edge arrives, so software can measure when it happened.

Internal fault id

An index used inside the program to select a diagnostic record. It is different from the reported OBD number and the legacy blink-code byte.

Interrupt

A signal that asks the processor to pause what it is doing and handle an event.

Interrupt service routine (ISR)

A small entry path that responds when the processor is interrupted. It may do work itself or ask the scheduler to do more.

Monitor qualification

Conditions and remembered observations that determine whether a diagnostic check may run and whether a result should be recorded.

P-number / trouble code

A diagnostic reporting code such as P0171. P means powertrain. The code identifies a condition the controller can report; it does not by itself identify a failed part.

Qualifying observation

A check result accepted after the relevant gates. It is not automatically a fixed amount of time or one driving trip.

Rich and lean

Rich means too much fuel relative to air. Lean means too little fuel relative to air.

ROM / flash image

A saved copy of program and calibration memory. It is not a recording of a running car.

Scheduler

The part of the program that chooses which ready job gets a turn.

SCI

A serial communication link used for diagnostic requests and responses.

Software-tracked position

A position the program remembers from its own requests. Without a traced feedback sensor, it is not proof of the actual mechanical position.

Stale reading

A saved value that has not received a fresh sample within the program’s allowed count. Its fallback value need not describe what the car is actually doing.

Substituted reading

A replacement value chosen from another signal, a stored value or an estimate. It is not a fresh measurement of the failed input.

Tick

One count of the scheduler's timebase.

Watchdog

A check that notices when expected activity has not happened. This program has checks for engine events and a separate processor watchdog.

Watchdog countdown

A value refreshed by expected activity and checked later. If the activity stops, an expiry path can change the software state. Here its unit is a check visit, not a confirmed number of seconds.

DESCRIPTION AND OPERATION

PCM SOFTWARE STRUCTURE

The Powertrain Control Module (PCM) is a digital computer containing a microprocessor. It receives input signals from switches and sensors and adjusts engine and vehicle operation through its outputs (Fig. 2). This manual describes the software in the PCM main processor of the 1997 Viper SR 8.0L V10, calibration 04848703AF.

The software does not run a single repeating list of engine calculations. After reset it initializes the hardware and settles in a one-instruction idle branch. All recurring work begins in interrupts. A periodic interrupt collects sensor readings and counts scheduler ticks; an engine-event interrupt records engine-position timing and flags each event. The periodic interrupt then carries the work through one chain of services: engine-speed calculation, engine-control dispatch (fuel and spark), serial and vehicle-speed service, and finally the job scheduler that runs the periodic jobs (Fig. 1).

The PCM selects its responses from preset programming and its current operating state, which the service manual calls the modes of operation (Fig. 3). In the software, those modes are flags and phase states that the engine-speed service and the scheduled jobs set, and that the fuel, spark and output routines read.

The manual follows the same order as the software. Each group below covers one stage of the paths in Fig. 1.

RESET AND FOREGROUND IDLE

The reset routine (020000) sets the bank registers, the stack and the common RAM base, then configures the chip selects, RAM mapping, analog converter, timer and serial modules. It loads the three periodic-group countdowns from the descriptors listed at ROM 0464 and reads the engine profile selector at ROM 2707. The value 02 selects the V10 engine profile at ROM 06CA and the ten fuel-output masks at ROM 08BA. Startup also queues the initial commands for the output hardware. Refer to 1-2 Startup and Initialization.

The reset routine lowers the interrupt mask at 0206AA, so interrupts are serviced during the remainder of startup. Near its end it writes 55 and then AA to the watchdog service register. Its final instruction jumps to the foreground idle branch (028500), a single branch to itself. The idle branch does not service the watchdog; the first job of the fastest periodic group (01FC58) does.

INTERRUPT-DRIVEN WORK

The periodic interrupt (028502) stores the analog converter results, services timer capture and overflow, updates vehicle-speed state and restarts conversion. Different sensor channels are processed on different visits. The interrupt then accounts for one scheduler tick (1-3, Fig. 1, 1-3 Job Scheduling). When engine-event maintenance is already running, the tick is added to the accumulated count F8006 and the interrupt returns. When the scheduler is active, the tick is accumulated for the scheduler to consume. Otherwise the countdown service (028906) decrements each group countdown directly and marks expired groups ready.

The engine-event interrupt (028F24) captures the event timestamps, updates synchronization history and profile state, reloads the engine-event watchdogs and sets work-pending flags. At and above the calibrated engine speed at ROM 2138, and with F80BC bit 40 set, it also sends the prepared fuel value of the bank selected by F80BC bit 20 (F82B0 or F82B2) directly to the output hardware. Refer to 2-1 Engine Position and Timing.

When the engine-event interrupt has captured an event, the periodic interrupt calls the engine-speed service (026CFC). It consumes the timestamp history, calculates engine speed F805A, updates the startup and running phase flags, and sets engine-control pending bits in F80D2. The dispatcher (028992) takes the lowest set bit, clears it, and calls the handler listed for it at ROM 0478 (1-3, Fig. 3, 1-3, Fig. 4). It repeats until no pending bit remains. The phase flags decide whether the startup or the running fuel and spark routines are requested.

When the pending bits are clear, the speed and serial service (01E14E) services the output queue, vehicle speed and the SCI link. When the SCI receiver holds data, the service calls the diagnostic service (00C800). Refer to 6-1 Vehicle Speed Input and 8-1 Diagnostic Overview. The service then enters the job scheduler, unless the scheduler is already running (Fig. 4).

01E2DEPULM  K,IZ,IX,E,D01E2E0BCLR  0xd1,Z,#0x4; maintenance done01E2E4BRCLR 0xce,Z,#0x2,0x01e2ee; scheduler active01E2EAJMP   0x010014; return01E2EEBSET  0xce,Z,#0x2; mark active01E2F2ANDP  #0xff2f01E2F6PSHM  IZ,K01E2F8JMP   0x010060; job scheduler

Two further interrupts operate alongside these paths. A level-5 interrupt (029F90) acknowledges its source and services the output queue. The SCI transmit interrupt (00EC5A) sends serial data from a table. The interrupt vectors are listed in 1-4, Fig. 2; refer to 1-4 Interrupts.

PERIODIC JOB SCHEDULING

Periodic jobs are organized in three groups, each a list of three-byte records: a job routine and its priority state. The scheduler (028B6A) scans the three group states and selects the ready group with the greatest priority. It runs one record of that group (028BB4), advances the group cursor, and scans again, so jobs of different groups interleave while each group keeps its listed order (1-3, Fig. 8). A record of FFFF ends a group. Ticks that arrive while a job runs are applied to the countdowns (028C4A) before the next scan. When no group is ready, the scheduler clears its active flag and returns from the interrupt.

A group that comes due while its previous release is still running is marked with state bit 80; it is not released twice. Within a group, many jobs run their full body only under their own conditions or subrates. Refer to 1-3 Job Scheduling, 1-5 Scheduled Jobs and 1-6 Supporting Jobs.

The fastest group carries the watchdog service, transmission dispatch and reverse lockout (6-2 Transmission Controls, 6-3 Reverse Lockout), coolant and intake-air filtering, deceleration and engine-speed cut requests, the changed discrete-output commands (029AFC), the engine-event watchdog expiry (013E3E), OBD requests, and the purge and oxygen-feedback jobs (5-2 Accessory and Evaporative Outputs, 3-2 Fuel Feedback). The slower groups carry fuel timers, transmission temperature, event-loss output state and fuel-cut profile countdowns.

OUTPUT HANDOFF AND FAULT RECORDS

The software sends its results to the output hardware as commands. The command queue (029270) holds them and the QSPI service (0293F6) transmits them. The running fuel routine stores bank results F82B0 and F82B2; the spark routine stores its final timing in F83D9 and queues spark command 24. Discrete requests in F8106 through F8108 are queued only when they change. Refer to 5-1 Output Commands.

When engine events stop, the event-watchdog expiry resets the engine-speed and phase state and enters the event-loss output path (2-2 Loss of Engine Events). Sensor faults substitute calibrated values (7-1 Substitute Values, 7-2 Sensor Recovery). Emission faults are stored as diagnostic trouble codes and are displayed by DRB or by blink code (8-2 Fault Reporting, 8-3 Blink Code Display, 8-4 Entering Blink Code Mode).

CPU exceptions use a separate path. The exception entries (0218C0 onward) record an internal fault byte at F8A06 and enter a port-write loop (021954). These internal codes are not diagnostic trouble codes.

SPECIFICATIONS

Group periods count periodic-interrupt ticks. Group 1 holds 4 jobs, group 2 holds 8 and group 3 holds 12.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

RESET ENTRY AND PROCESSOR SETUP

Every reset of the PCM main processor enters the reset routine (020000). The routine runs once, from top to bottom, and prepares the processor, memory, engine profile and companion devices before any engine control work is allowed to run (Fig. 2).

The first instructions set the stack and Z bank registers to F and the remaining bank registers to 0, place the stack at F8FFC and set the common data base to F8000. The routine then programs the system integration module: clock synthesizer, system protection, chip selects and port E. It services the software watchdog with the 55, AA sequence as part of this setup (Fig. 1). The analog converter, general-purpose timer and queued serial module are configured next, and the queued serial transfer memory is cleared.

020000LDAB  #0xf020002TBZK  ; Z bank = F020004TBSK  020006LDS   #0x8ffc; stack F8FFC02000ALDZ   #0x8000; base F800002000ELDAB  #0x0020010TBEK  020012TBXK  020014TBYK  020016LDAA  #0x7f020018STAA  0x7a04,Z; clock synthesizer02001CLDAA  #0xb402001ESTAA  0x7a21,Z; system protection020022LDAA  #0x55020024STAA  0x7a27,Z; watchdog 55020028LDAA  #0xaa02002ASTAA  0x7a27,Z; watchdog AA

RETAINED MEMORY CHECK

Working memory is divided into two areas. The area from F8000 to F87FF holds the running state of every control routine. The area from F8800 to F8A04 holds retained state, including the active and stored fault flags and the blink-code arming count. A check word at F8800 protects the retained area.

Startup calls the retained-sum routine (013D08), which adds the 515 bytes from F8802 to F8A04 into a 16-bit sum, and compares the result with the check word (Fig. 3).

• Sum matches. The retained area is kept, including the blink-code arming count at F89A6. Startup overwrites the check word and continues.
• Sum does not match. Startup clears F8800 through F8A05 and seeds the retained area with default values read from calibration. The active fault flags at F8808 and the arming count are cleared.

Both paths then clear the working area F8000 to F87FF, so the working area starts from zero on every reset. Later in startup the reset routine also clears the active fault flags of selected checks (7-2 Sensor Recovery). The power-input service (013A66) stores a fresh sum in F8800 when it saves retained state. Blink-code arming and its use of the retained count are described in 8-4 Entering Blink Code Mode.

0201ECJSR   0x013d08; sum F8802–F8A040201F0CPD   0x800,Z; check word F88000201F4BNE   0x0202060201F6LDD   0x805,Z0201FATBA   0201FCCOMB  0201FESTD   0x800,Z020202LBRA  0x020392; keep retained area020206CLRW  0x800,Z; clear retained area02020ACLRD  02020CLDE   #0x800020210STD   E,IZ020212ADDE  #0x2020214CPE   #0xa05; through F8A05020218BCS   0x020210020392LDE   #0x0; working area020396CLRD  020398STD   E,IZ02039AADDE  #0x202039CCPE   #0x800; through F87FF0203A0BCS   0x020398

ENGINE PROFILE SELECTION

The program image serves several engine configurations. A single selector byte at ROM 2707 chooses which one runs. Eight selector values each name a profile record, a mask table and a two-byte configuration pair; a selector outside the eight takes a default profile (Fig. 4).

The Viper selector is 02. It selects the ten-cylinder profile at ROM 06CA and the mask table at ROM 08BA. Startup stores the profile pointer at F8058 and the mask-table pointer at F8177, where the engine-event and fuel routines read them. The configuration pair from ROM 2134 is stored at F8012 and F8013.

The profile carries the firing sequence at ROM 06E4 as ten zero-based cylinder numbers. Adding one to each entry gives 1-10-9-4-3-6-5-8-7-2, the firing order of the 8.0L V10 engine (Fig. 5). Refer to Specifications. The contents of the profile and the routines that read it are described in 0-2 Reference Image Identification.

void viper_select_engine_profile_fragment(const ViperBus *b, uint8_t incoming_b)
{
    static const struct { uint8_t selector; uint16_t profile, masks, aux; } cases[] = {
        {0x80,0x0488,0x086A,0x2128}, {0x40,0x04E6,0x0872,0x212A},
        {0x20,0x054C,0x087E,0x212C}, {0x10,0x05AC,0x088A,0x212E},
        {0x08,0x060A,0x089A,0x2130}, {0x04,0x0668,0x08BA,0x2132},
        {0x02,0x06CA,0x08BA,0x2134}, {0x01,0x072C,0x08AA,0x2136}
    };
    uint8_t a = b->read8(b->context, VIPER_PROFILE_SELECTOR);
    uint8_t rb = incoming_b;
    uint16_t profile = 0x078A, masks = 0x086A;
    size_t i;
    for (i=0; i<sizeof(cases)/sizeof(cases[0]); ++i) {
        if (a == cases[i].selector) {
            profile=cases[i].profile; masks=cases[i].masks;
            a=b->read8(b->context,cases[i].aux);
            rb=b->read8(b->context,(uint32_t)cases[i].aux+1u);
            break;
        }
    }
    b->write16(b->context,VIPER_PROFILE_POINTER,profile);
    b->write16(b->context,VIPER_OUTPUT_MASK_POINTER,masks);
    b->write8(b->context,VIPER_GLOBAL_BASE+0x13u,a);
    b->write8(b->context,VIPER_GLOBAL_BASE+0x12u,rb);
}

With the profile in place, startup sets the startup-fuel phase flag (F80D1 bit 80) and the spark-initialization phase flag (F80D1 bit 20). The first engine events therefore schedule the startup fuel calculation and spark initialization instead of the running calculations. Startup also loads the engine-event watchdog count at F80C7 from ROM 2104. Phase changes after the first events are described in 2-1 Engine Position and Timing.

COMPANION PROCESSOR CHECK

The PCM main processor exchanges commands with a companion processor over the queued serial peripheral interface. Before it sends any configuration, startup waits for the timer pulse accumulator to count, then performs a two-transfer check (Fig. 7).

The first transfer sends the first byte of the selected profile, 09. The reply is stored at F816E and F8511. The second transfer sends zero. The second reply, added to the profile byte, must equal zero. Any other reply sends the processor back to the reset entry, and the complete startup sequence runs again. After a correct reply the two-transfer check runs a second time, with the same restart on a wrong reply.

020510LDAA  0x790d,Z; wait for pulse count020516LDX   0x58,Z02051ALDAB  0x0,X; profile byte02051ESTD   0x7d20,Z; first transfer02052ELDE   #0x8404020532STE   0x7c1a,Z020536LDAA  0x7c1f,Z; wait for completion020542LDAA  0x7d01,Z; first reply020546STAA  0x16e,Z020556CLRW  0x7d20,Z; second transfer: zero02055ASTE   0x7c1a,Z02055ELDAA  0x7c1f,Z020576LDAB  0x7d01,Z; second reply02057ALDAA  0x0,X02057CABA   ; reply + profile byte02057ELBNE  0x020000; nonzero: restart

INITIAL COMMANDS AND SENSOR READINGS

Directly after the working-area clear, before profile selection, startup loads the three periodic work-group countdowns at F8000, F8002 and F8004 from the group descriptors listed at ROM 0464. It then runs a calibrated delay of 16000 loop counts.

The routine sends its initial configuration and output states to the companion processor through the command queue (029270) and drains the queue with the serial queue service (0293F6). The routine contains fifty command requests. Partway through, at 0206AA, startup relaxes the interrupt priority mask and waits until the queue holds four entries or fewer. From this point interrupt service runs alongside the rest of startup. Interrupt routing is described in 1-4 Interrupts.

Startup takes the first sensor readings with the same routines the running software uses. Temperature readings are converted through the thermistor curve at ROM 0410. The coolant reading passes through the coolant range check (019C06). A rejected reading is not used at once: startup starts a fresh conversion and checks the new result (Fig. 8). When the second reading is also rejected, startup checks the intake air reading (019CDC) and takes the coolant substitute value (01F99A). The accepted or substituted coolant value is stored as both the working value F80A6 and the start value F80A7. The MAP reading is converted with its fallback routine (029A56), and the coolant-dependent transient fuel parameters are set (013954). The service manual describes the PCM's key-on, zero-rpm inputs in Ignition Switch On (Zero RPM) mode (Fig. 9).

020D92JSR   0x010070; range check020D96BRCLR 0x11f,Z,#0x10,0x020dce; accepted020D9CLDE   #0x30; start conversion020DA0STE   0x770c,Z020DA4LDAA  0x770e,Z; wait for completion020DA8BPL   0x020da4020DAALDD   0x7712,Z; new reading020DAESTD   0x34,Z020DB2JSR   0x010070; check again020DB6BRCLR 0x11f,Z,#0x10,0x020dce020DBCJSR   0x010074; intake air check020DC0JSR   0x01f99a; coolant substitute020DC4LDAB  0xa6,Z020DC8STAB  0xa7,Z020DCCBRA   0x020de2020DCELDX   #0x410020DD2LDE   0x34,Z020DD6JSR   0x010050; thermistor curve020DDASTAB  0xa6,Z; working value020DDESTAB  0xa7,Z; start value

HANDOFF TO INTERRUPT OPERATION

The last block of startup services the watchdog with 55, AA, writes the general-purpose timer control word and clears the interrupt priority mask (Fig. 10). The routine then jumps through the bank-1 entry at 01001C to the idle branch at 028500. That instruction branches to itself.

The idle branch carries no control work. Engine events, the periodic timer and the serial interfaces enter through interrupts, and the job scheduler runs the periodic work groups from the interrupt frame (1-3 Job Scheduling). The idle branch does not service the watchdog; the first scheduled job wrapper (01FC58) does (1-5 Scheduled Jobs).

021768LDAA  #0x5502176ASTAA  0x7a27,Z; watchdog 5502176ELDAA  #0xaa021770STAA  0x7a27,Z; watchdog AA021778LDE   #0x10202177CSTE   0x7920,Z; timer control021780ANDP  #0xff0f; open interrupt mask02179CJMP   0x01001c; to idle 028500

DIAGNOSIS AND TESTING

PROCESSOR EXCEPTION STOPS

Processor exceptions and unexpected interrupt levels do not return to normal operation. Each exception vector leads to a short entry that stores an exception code at F8A06, just above the retained area, and enters the port latch loop (021954). The loop repeatedly writes port C with bits 08 and 80 cleared and does not service the watchdog. The entries and their codes are listed in 1-4 Interrupts. These codes are internal processor records; they are separate from the diagnostic trouble codes described in 8-2 Fault Reporting.

REPEATED STARTUP

A wrong second reply in the companion processor check returns the main processor to the reset entry before any configuration commands are sent. Each repeat clears working memory and repeats the retained-sum check, profile selection and companion check in full.

SPECIFICATIONS

Profile entries are zero-based cylinder numbers stored from ROM 06E4. Work group periods are scheduler ticks.

DESCRIPTION AND OPERATION

INTERRUPT-DRIVEN WORK

The PCM software has no foreground loop that calls fuel, spark and diagnostic routines in turn. Startup (020000) ends at an idle branch (028500) that jumps to itself. All recurring work enters from interrupts (1-4 Interrupts).

Two kinds of work are kept. Pending engine work is a set of eight request bits at F80D2 that engine events set; each bit selects one entry of the pending-work table. Periodic work is three groups of jobs, each released by its own countdown of scheduler ticks. Pending engine work always runs ahead of periodic work, and a periodic job can be interrupted to serve it.

The periodic interrupt (028502) supplies the tick. After it samples the converters and services timer capture, its tail decides how the tick is used (Fig. 1):

• When engine work is in progress (F80D1, bit 04), the tick is added to the elapsed-tick count F8006 and the interrupt returns at once.
• When a periodic job is running (F80CE, bit 02), the tick is added to F8006 (02896A). The scheduler applies it after the current job.
• Otherwise the tick is applied directly: each group countdown decreases by one (028906).

Both of the last two paths then set the engine-work flag. When a captured engine event is waiting (F80CE, bit 04), the engine-speed routine (026CFC) runs with the interrupt mask raised and sets the pending bits for that event (2-1 Engine Position and Timing). The pending bits are then served, followed by the shared speed and serial service (01E14E), which clears the engine-work flag. If a periodic job was interrupted, the interrupt returns into that job. If not, the routine sets the scheduler-active flag, lowers the interrupt mask and enters the scheduler.

PENDING ENGINE WORK

The engine-speed routine reads a flag byte for each engine event from the engine profile (Fig. 2). One flag requests the engine-interval history job (bit 04). Another requests spark timing: bit 10 selects spark initialization while the spark-initialization phase flag F80D1 bit 20 is set, and bit 02 selects ordinary spark timing otherwise. A third requests fuel: bit 08 selects startup fuel while the startup-fuel phase flag F80D1 bit 80 is set, and bit 01 selects running fuel otherwise. The fuel and spark jobs are described in 3-1 Fuel Amount and 4-1 Spark Timing.

The pending-work dispatcher (028992) serves the bits in order from bit 01 upward (Fig. 3). It clears the selected bit before it calls the job. The job address comes from the pending-work table at ROM 0478 (Fig. 4). After each job, when the QSPI command queue holds work (F80CD not zero), the queue service (0293F6) runs before the next bit is chosen. The dispatcher repeats until F80D2 is zero. Bits 20, 40 and 80 point to entries that return at once.

026E7CLDAB  0xbd,Z026E80CLRA  026E82TDE   026E84LDAB  E,IX; event flag byte026E86BITB  #0x10026E88BEQ   0x026e8e026E8ABSET  0xd2,Z,#0x4; interval history026E8EBITB  #0x1026E90BEQ   0x026ea2026E92BRCLR 0xd1,Z,#0x20,0x026e9e; F80D1.20?026E98BSET  0xd2,Z,#0x10; spark initialization026E9CBRA   0x026ea2026E9EBSET  0xd2,Z,#0x2; ordinary spark026EA2BITB  #0x2026EA4BEQ   0x026eb6026EA6BRCLR 0xd1,Z,#0x80,0x026eb2; F80D1.80?026EACBSET  0xd2,Z,#0x8; startup fuel026EB0BRA   0x026eb6026EB2BSET  0xd2,Z,#0x1; running fuel

028964ASLB  ; next bit028966ADDE  #0x2028968BRA   0x0289a4028992PSHM  IX,K028994CLRB  028996TBXK  028998LDX   #0x478; table ROM 047802899CLDAA  0xd2,Z; pending bits F80D20289A0LDAB  #0x10289A2CLRE  0289A4RORA  ; lowest bit first0289A6BCC   0x0289640289A8COMB  0289AAANDB  0xd2,Z; clear bit0289AESTAB  0xd2,Z0289B2PSHM  D,E,IX,IY,IZ,K0289B4AEX   0289B6LDX   0x0,X0289B8JSR   0x1:0x0,X; call job0289BCPULM  K,IZ,IY,IX,E,D0289BETST   0xcd,Z; QSPI queue waiting?0289C2BEQ   0x0289cc0289C4PSHM  D,E,IX,IY,IZ,K0289C6JSR   0x01002c; serve queue0289CAPULM  K,IZ,IY,IX,E,D0289CCTST   0xd2,Z; more pending?0289D0BNE   0x0289980289D2PULM  K,IX0289D4JMP   0x010020; speed and serial service

PERIODIC WORK GROUPS

The number of periodic groups is stored at ROM 040E (3). ROM 0464 holds a pointer to each group descriptor. A descriptor begins with the group's reload count in ticks, followed by three-byte job records: a two-byte job address and a state byte. A word of FFFF ends the group (Fig. 8). The complete group listings are in 10-2 Work Schedule Tables.

Each group keeps three values in RAM: a countdown (F8000, F8002, F8004), a record cursor (F8014, F8016, F8018) and a state byte (F8028, F8029, F802A). Startup loads each countdown from its descriptor (1-2 Startup and Initialization).

When a countdown reaches zero, it is reloaded with the group period (Fig. 5). An idle group (state zero) becomes ready: its cursor is set to the first record and its state to that record's state byte. A group that is still working through its records is not restarted; its state receives bit 80 instead, which marks the pass as overrun. A release that occurs during an overrun pass adds no further mark.

028928DECW  0x0,Z; countdown − 102892CBNE   0x02895202892EPSHM  IX,IY028930AEY   028932LDY   0x0,Y028934LDD   0x0,Y; reload count028936STD   0x0,Z028938LDAB  0x0,X; group state02893ABEQ   0x02894202893CORAB  #0x80; overrun mark02893ESTAB  0x0,X028940BRA   0x028950028942AIY   #0x2; first record028944LDAA  0x2,Y; first state byte028946STAA  0x0,X028948LDX   #0x801402894CAEX   02894ESTY   0x0,X; record cursor028950PULM  IY,IX028952AIZ   #-0x2028956AIX   #-0x102895ASUBE  #0x2; next group02895EBPL   0x028928

JOB SELECTION AND EXECUTION

The scheduler selects the group whose state byte has the greatest low-order digit (028B6A, Fig. 6). The state byte of a group's current record is therefore its priority. All records carry state 08 except the fourth record of group 1, which carries 07. Within a pass the scan begins at the group selected last, and a later group of equal value replaces the earlier choice, so groups of equal priority take turns. When no group is ready, the scheduler clears the scheduler-active flag and returns from the interrupt to the idle branch or to the interrupted code.

The record service (028BB4) calls one job, then advances the cursor by one record (Fig. 7). The group state is updated as follows:

• Next record present, no overrun mark: the state becomes that record's state byte.
• Next record present, overrun mark set: when the next state byte is lower than the first record's, the group restarts at its first record; otherwise the group continues and keeps the mark.
• End of group, no overrun mark: the state is cleared and the group is idle.
• End of group, overrun mark set: the group restarts at its first record.

In group 1, an overrun pass therefore returns to the first record without running the fourth job.

After each job the scheduler checks F8006. When ticks have accumulated, the update service (028C4A) subtracts them from all three countdowns. A countdown that reaches or passes zero is released as described above; when the overshoot is smaller than the period, the remainder is carried into the new count. The consumed ticks are then subtracted from F8006 with the interrupt mask raised, so ticks that arrive during this update are kept. The scheduler then selects again.

028B6ACLRD  028B6CPSHM  D028B6ETSY   028B70LDAB  #0xf028B72TBXK  028B74LDX   #0x8028; group states F8028028B78LDE   0x0,Y; start at last group028B7CCLRD  028B7EPSHB  028B80LDAB  E,IX028B82ANDB  #0xf; priority digit028B84STAB  0x139,Z028B88PULB  028B8ACMPA  0x139,Z; best so far028B8ELBLE  0x028cde; equal or greater wins028B92ADDE  #0x1028B94CPE   0x40e; group count ROM 040E028B98BCS   0x028b9c028B9ACLRE  028B9CCPE   0x0,Y028BA0BNE   0x028b7e028BA2CMPA  #0x0; none ready028BA4LBEQ  0x028ce8028BA8CLRA  028BAATDE   028BACSTE   0x0,Y; remember group028BB0JMP   0x010064; run one record

INTERRUPTED JOBS

A periodic job runs with the interrupt mask lowered. When the next periodic interrupt arrives during the job, its tail finds the scheduler-active flag set: the tick is counted, captured engine events and pending engine work are served, and the interrupt returns into the job. A second scheduler pass never starts on top of the first. Engine work thus interrupts periodic work, while periodic work never interrupts engine work. The jobs in each group are described in 1-5 Scheduled Jobs and 1-6 Supporting Jobs.

SPECIFICATIONS

Periods are counted in periodic-interrupt ticks. Job addresses in the tables are offsets in bank 1.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

INTERRUPT-DRIVEN OPERATION

The PCM software runs from interrupts. When the startup routine (020000) finishes, it jumps to an instruction at 028500 that branches to itself (028500). The program performs no work at that location. Sensor collection, engine-event processing, fuel and spark computation, the scheduled jobs and the diagnostic data stream are all entered from interrupt handlers. Startup enables interrupts before its own work is complete, so startup and interrupt service overlap. Refer to 1-2 Startup and Initialization.

The vector table begins at ROM 000000. Each vector number has a 16-bit slot at twice its number, so vector 38 occupies slot 0070. The 252 slots from 000008 to 0001FE lead to two kinds of destination (Fig. 2):

• Four returning routes. The periodic interrupt, the engine-event capture, the level-5 request and the SCI transmit interrupt. Each handler saves the CPU registers, sets the common RAM base to F8000, performs its work and returns to the interrupted code with an RTI instruction.
• Fault traps. The remaining 248 slots lead to 14 trap entries that never return.

The first three slots point to jump instructions in the bank-0 entry area; the SCI slot points directly at its handler. Five RTI instructions serve the four routes: 028CF2 (periodic service and job scheduler), 02926E (capture), 029FA8 (level 5), and 00ECA8 and 00ECC0 (SCI).

PERIODIC INTERRUPT

The periodic interrupt service (028502) is the time base of the program. Startup writes the control value 0338 to the periodic interrupt control register, which selects vector 38. Each pass performs the following work:

• Analog collection. The service waits for the analog converter to report a completed sequence and stores the results. Port C bits 10 and 40 are inverted on every pass, and the new state selects the result block: F8032–F8041, with five results scaled by the factor at F831D and limited to FFC0, or F8042–F804D unscaled. Before it leaves, the service writes the converter control word that starts the next sequence.
• Timer service. The free-running timer count is copied to F8050, timer overflows are counted at F8052, and vehicle speed sensor pulses are timestamped. Refer to 6-1 Vehicle Speed Input.
• Scheduler tick. The tail of the service decides how the tick is counted (Fig. 3).

The tail counts the tick in one of three ways: into the elapsed-tick count F8006 when event maintenance is already in progress (F80D1, bit 04), through 02896A when a scheduled job was interrupted (F80CE, bit 02), or directly into the group countdowns through 028906. The service then sets F80D1 bit 04 and performs event maintenance: the engine speed routine (026CFC) when the capture handler has recorded an engine event (F80CE, bit 04), the pending-work dispatcher (028992) and the shared tail (01E14E), which services the command queue, vehicle speed and SCI status. It then returns to an interrupted job, or enters the job scheduler (028B6A), which leaves through the RTI at 028CF2. The complete tick path is shown in 1-3, Fig. 1; the scheduler is described in 1-3 Job Scheduling.

0288BALDE   #0x30; converter control0288BESTE   0x770c,Z; start next sequence0288E8BRCLR 0xd1,Z,#0x4,0x0288f6; busy0288EEINCW  0x6,Z; elapsed ticks F80060288F2JMP   0x010014; restore and RTI0288F6BRCLR 0xce,Z,#0x2,0x028900; job active0288FCJMP   0x010018; accumulate tick028900PSHM  IZ,K028902JMP   0x010054; count down groups

ENGINE-EVENT CAPTURE

Startup writes the timer interrupt configuration 0440, which places the timer vectors at 40; input-capture channel 1 uses vector 41. The capture handler (028F24) records each engine event and leaves the computation to the periodic service (Fig. 4):

• The event time is read from the timestamp words at 50004 and 50006 and stored at F813B, and the capture flag is cleared.
• If the previous event flag is still set, the counter at F80BE increments. The handler then sets F80CE bits 04 and 40 and F80CF bit 08, and increments the event count at F8054.
• The two engine-event watchdog counters F80C6 and F80C7 reload from ROM. The fast watchdog job (013E3E) counts them down; an expired counter starts the event-loss path. Refer to 2-2 Loss of Engine Events.

On the first captured event (F80CE, bit 10 clear), the handler clears the event-loss requests (F8106 bits 40 and 80, F8108 bit 04) and, unless F80CC bit 40 is set, queues output command 04 and, when the queue has room, command 2D. The complete first-event sequence is described in 2-2 Loss of Engine Events; the commands in 5-1 Output Commands.

At engine speeds at or above 5500 rpm, with F80BC bit 40 set, the handler also queues the prepared fuel word for the bank selected by F80BC bit 20 (F82B0 or F82B2) as command 13 and services the command queue before it returns. Below that speed the fuel job (0109DC) sends the word itself. Refer to 3-1 Fuel Amount.

028F38LDE   0x6; timestamp 50006028F3CLDD   0x4; timestamp 50004028F40ANDA  #0xf028F42BCLR  0x7922,Z,#0x1; clear capture flag028F46STE   0x13b,Z028F4ASTD   0x13d,Z028F4ECLRB  028F50TBEK  028F52LDAA  0x7a19,Z028F56STAA  0xc5,Z028F5ABRCLR 0xce,Z,#0x4,0x028f64; prior event028F60INC   0xbe,Z; unconsumed events028F64BSET  0xce,Z,#0x44; event captured028F68BSET  0xcf,Z,#0x8028F6CINCW  0x54,Z; event count028F70LDAA  0x2100; ROM 2100028F74STAA  0xc6,Z028F78LDAA  0x2101; ROM 2101028F7CSTAA  0xc7,Z

LEVEL-5 REQUEST

The command-queue service (0293F6) sets bit 20 of register FFA1F when it finishes with transfers still pending (F80CD or F80E4 nonzero); startup clears the register. The level-5 handler (029F90) clears bit 20, calls the queue service through 01002C, restores the registers and returns (Fig. 5). Pending output commands therefore receive service outside the periodic and capture handlers.

029F90PSHM  D,E,IX,IY,IZ,K; save registers029F92LDAB  #0xf029F94TBZK  029F96LDZ   #0x8000; RAM base F8000029F9ACLRB  029F9CTBEK  029F9EBCLR  0x7a1f,Z,#0x20; clear FFA1F bit 20029FA2JSR   0x01002c; command-queue service029FA6PULM  K,IZ,IY,IX,E,D029FA8RTI   ; return

0296C8TST   0xcd,Z; transfers pending0296CCBNE   0x0296d60296CETST   0xe4,Z; queue entries0296D2BNE   0x0296d60296D4BRA   0x0296e60296D6BCLR  0xcc,Z,#0x800296DALDAA  0x7a1f,Z0296DEORAA  #0x20; set FFA1F bit 200296E0STAA  0x7a1f,Z0296E4BRA   0x0296ea0296E6BCLR  0xcc,Z,#0x800296EARTS   

SCI TRANSMIT INTERRUPT

The DRB scan tool communicates with the PCM over the SCI circuits (Fig. 7). The SCI link does not use an interrupt to receive: the periodic interrupt tail polls the receive flag (01E14E), and the transmit routine waits for the transmitter before it writes each byte (8-7 Scan Tool Commands).

The program also holds a table stream on vector 4E. Its setup routine (00EC08) selects one of five address lists through the pointer table at ROM F659, clears the list position at F8345, writes interrupt vector 4E and enables the transmit interrupt. No instruction in this image calls the setup routine and no command table holds its address, so the transmit interrupt is never enabled and the stream is not sent.

When enabled, each transmit interrupt (00EC5A) reads the next list entry and sends one byte from working RAM. Addresses from F8000 up to, but not including, F8A05 are permitted. The stream ends when the next entry is FFFF or after 32 positions; an address outside the permitted range sends zero and ends the stream. At the end the handler disables the transmit interrupt. The stream reads only the listed RAM bytes. Refer to 8-1 Diagnostic Overview.

FAULT TRAPS

Each of the 248 fault slots leads to a short trap entry that stores a marker byte at F8A06 and jumps to the trap loop (021954). The marker is the vector number; the 235 unused slots share the default entry (02194A), which stores FF. The bus-error entry (0218CA) reloads the RAM base before it stores its marker. The trap loop clears port C bits 80 and 08 and repeats the port write indefinitely (Fig. 8). A trap does not return to the interrupted work.

The marker is a CPU exception number. It is not a diagnostic trouble code and is not a blink code. Refer to 8-2 Fault Reporting.

021954LDAA  0x7a41,Z; port C021958ANDA  #0x77; clear bits 80, 0802195ASTAA  0x7a41,Z; write port02195EBRA   0x02195a; repeat

SPECIFICATIONS

Values at 0201xx and 00ECxx are instruction operands in the startup and SCI routines. Engine speed converts at one rpm per eight counts.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

JOB GROUPS

The scheduler releases three periodic groups of jobs, reloaded every 22, 172 and 1953 scheduler ticks (1-3 Job Scheduling). This section describes the smaller jobs that collect readings, keep counters and prepare output requests. The larger control functions have their own sections.

A job runs on every visit of its group, but most jobs test a counter, a flag or the command queue first and return without change when the test fails. The fast group calls its jobs through four wrapper routines. The medium and slow groups call each job from its own schedule record (Fig. 1).

RADIATOR FAN CONTROL

The PCM controls the radiator fan through two relays: the radiator fan ON relay and the radiator fan LOW/HIGH relay (Fig. 5). The fan job (01FA22) runs last in the slow group. It holds the ON relay request in F8107, bit 40, and the LOW/HIGH relay request in F8108, bit 01. The job compares the coolant value against calibrated pairs of thresholds, and the pair in use depends on road speed and on the present state of each request (Fig. 2).

The job returns without change when calibration option 2709 bit 80 is set, or when F8128 bit 08 is set. While the engine-running flag F80D1.40 is clear, the job sets F8107.40, so the fan does not run during cranking. When the coolant sensor fault flag F8808.80 is set, the job clears F8107.40 and moves to high speed, the limp-mode operation the manual describes (Fig. 4).

In normal operation, and with option 2709 bit 40 set, the high-speed stage is tested first. Below the road-speed threshold, the LOW/HIGH request is applied at 102 °C and released below 98 °C. Release sets F8108.01 and clears F8107.40, so the fan returns to low speed. The change to high speed is delayed: each pass decrements a countdown at F868C, loaded with 4, and F8108.01 clears only when the countdown reaches zero.

While the LOW/HIGH request is released and coolant is below the high-speed threshold, the low-speed stage runs. Below the road-speed threshold the job clears F8107.40 at 97 °C and sets it again below 94 °C (Fig. 3). These are the fan ON and OFF temperatures documented in the service manual. When F810B bits 02 and 04 are both set, the job requests low speed without testing coolant.

Each stage keeps its own road-speed flag (F8674.04 for the low-speed stage, F8674.02 for the high-speed stage). The flag sets below raw speed B4 and clears only at C8, so the band does not cycle. Above the threshold the job uses a second pair of temperatures, 184 °C and 190 °C, which releases the fan at road speed. The manual documents this as the fan turning off at 77 mph and back on at 67 mph.

The ON and LOW/HIGH relay requests leave the PCM through the output-command service (5-1 Output Commands). The PCM grounds the ON relay on circuit C27 and the LOW/HIGH relay on circuit C137.

01FAAABRCLR 0x674,Z,#0x4,0x01fab6; speed band flag01FAB0LDAA  0x271401FAB6LDAA  0x271301FABALDAB  0xa6,Z01FABECMPA  0xa4,Z; road speed01FAC4BSET  0x674,Z,#0x401FAC8BRSET 0x107,Z,#0x40,0x01fad6; fan on?01FACECMPB  0x2715; off below01FAD2BCS   0x01fb3e01FAD6CMPB  0x2716; on at or above01FADABCC   0x01fb22

COUNTERS AND CORRECTIONS

Temperature filters. The temperature filter job (01391E) does its work only when the low six bits of counter F8097 equal 3E. On that visit it decrements the countdowns at F8024 and F83E3, runs the coolant temperature filter (01F926) and the intake air temperature filter (01F8BC), and calls the RPM-drop fuel preparation (1-6 Supporting Jobs). While the engine is stopped it also gives the blink-code formatter (013EF4) its turn (8-3 Blink Code Display).

Running age. The running-age job (0139F4) increments the counter at F80C4 on each slow-group visit while the engine-running flag is set. The counter stops at FF. The engine-speed routine clears it when the engine returns to the startup-fuel phase (2-1 Engine Position and Timing).

The running-age correction (013720) reads that counter together with the coolant temperature recorded at start (F80A7). After a delay of 0 counts it takes a value from the curve at 32F1 and tapers it to zero over 0 further counts. The result is stored at F82D2. Both calibration values are zero in this image, so the routine stores zero on every visit (Fig. 6).

013720CLRB  013722LDAA  0x32f0; taper length013726ADDA  0x32ef; delay01372ACMPA  0xc4,Z; running age01372EBCS   0x01376a013730LDAA  0x32ef013734CMPA  0xc4,Z013738BHI   0x01376e01373ACLRB  01373CTST   0x32f0013740BEQ   0x01376a013742LDX   #0x32f1013746LDAA  0xa7,Z; coolant at start01374AJSR   0x010030; curve 32F101374ELDAB  0x32ef013752ADDB  0x32f0013756SUBB  0xc4,Z01375AMUL   ; scale by remaining counts01375CXGDX  01375ECLRA  013760LDAB  0x32f0013764XGDX  013766IDIV  ; divide by taper013768XGDX  01376ASTAB  0x2d2,Z; correction F82D201376ERTS   

Injector offset. The medium-group fuel timer job (013426) reads the injector offset curve with the value at F816E and stores the curve result at F826F. The slow-group job 01365C sends that byte to the companion processor as command 1D, select 1D, when fewer than nine commands wait in the queue (F80E4). The command carries the curve result only. The medium-group job (013426) also forms the complete signed injector offset at F82B4 (3-1 Fuel Amount).

STATUS REQUESTS

Two medium-group jobs queue requests to the companion processor through the command queue (029270). Each request is queued only when the queue has room. The status and configuration job (014136) sends command 2A, select 1E, which returns the value at F816E used by the injector offset curve. It also sends command 25, which returns F82D9, and a set of configuration requests. The bitfield job (018A7C) sends commands 7A, select 1D, and 69, select 1E, and decodes the returned bits through the tables at C26E and C274.

SHARED PORT AND SPEED SAMPLE SERVICES

Four request bits share pins on processor port GP. Inside the first fast wrapper (01FC58), the drive routine copies bits 3 to 6 of the request byte F8502 to PORTGP and makes those pins outputs. Two calls later, after the throttle reference and barometric pressure updates, the release routine returns the same pins to inputs (Fig. 8). The reverse lockout request travels on this port (6-3 Reverse Lockout).

In the second fast wrapper, the mismatch routine (01A058) compares PORTGP bits 5 and 6 with the request byte. A bit requested set that reads clear is latched in F84FE; a bit requested clear that reads set is latched in F84FF. The fault qualification routine (01A138) checks PORTGP bits 3 and 4 against their requests with the counters at F84EC and F84ED, and latches F8496 bits 01 and 02.

01A02ALDAA  0x502,Z; request byte F850201A02EANDA  #0x78; bits 3–601A030LDAB  #0x7801A032COMB  01A034ANDB  0x7907,Z01A038ABA   01A03ASTAA  0x7907,Z; PORTGP01A03ELDAB  0x7906,Z01A042ORAB  #0x78; pins to outputs01A044STAB  0x7906,Z; DDRGP01A048RTS   

Speed sample expiry. The periodic interrupt service (028502) reloads a lifetime count at F80A3 with each fresh sample. The expiry job (01E114) decrements a nonzero count and returns. A visit that finds the count at zero clears the road-speed value at F80A4, the working words at F8135 and F8648, and flag F80D6.01. With option 2707 bit 02 set, it also loads FFFF into the words at F8084 and F8086 (6-1 Vehicle Speed Input).

RETAINED STATE

The power input job (013A66) follows a state machine driven by PORTF0 bit 01. On its hold paths it sums the 515 bytes of retained working memory F8802 to F8A04 (013D08) and stores the 16-bit sum at F8800. One path clears F89A6 before taking the sum. At the next reset, the startup code compares the sum with F8800: a match preserves retained state, and a mismatch reinitializes it (1-2 Startup and Initialization).

013D08LDAB  #0xf013D0ATBXK  013D0CCLRD  013D0ELDX   #0x8802; first byte F8802013D12ADDB  0x0,X; add byte013D14BCC   0x013d18013D16INCA  ; carry to high byte013D18AIX   #0x1013D1ACPX   #0x8a05; end F8A05013D1EBCS   0x013d12013D20RTS   

DIAGNOSIS AND TESTING

DRB OUTPUT TESTS

The DRB radiator fan tests operate the same request bits as the fan job. A test therefore exercises the same output path as normal fan control.

DIAGNOSTIC TROUBLE CODES

The PCM monitors both fan relay control circuits. An open or shorted circuit sets the code shown in Fig. 10.

SPECIFICATIONS

Coolant temperature is the stored value minus 64 °C. Road speed is the raw value of F80A4.

DESCRIPTION AND OPERATION

IDLE AIR CONTROL

The PCM adjusts idle speed through the idle air control motor (Fig. 3). The software keeps two positions for the motor: the requested position at F8612 and the tracked position at F8810. The idle air service (021960) runs in the first fast wrapper. It updates the requested position from the engine-running state, the settle count at F8614 and its target, speed, pressure and A/C transition corrections (5-3 Idle Air Control).

At the end of each pass the service hands the request to the movement routine (0223B6) when the supply value at F816E is at or above 7A and engine speed is at or below 8000 rpm. The movement routine takes the difference between the tracked and requested positions and limits each move to 1F steps. While F8847 bit 80 is set, a move waits for the previous reply and is limited to 3 steps. The routine updates the tracked position by the amount moved and forms a command byte: the step count in the low five bits, the direction and mode in the upper bits (Fig. 2).

The queue routine (022432) marks the reply byte F8615 pending (FF) and sends the byte as command 22, select 1E. Calibration option 2708 bit 40 blocks the command; the bit is clear in this image. The reply is polled into F8615 by 022452. In the reset mode (F880F bit 08) the routine counts the tracked position down to zero.

When both positions are zero and F80D6 bit 01 is clear, the slow-group seed job (02246E) loads 2 into both and sets F880F bit 04. The three DRB idle air tests write the same requested position, so a test moves the motor through the normal movement path (Fig. 1).

0223C4LDAB  0x810,Z; tracked position0223CESUBB  0x612,Z; minus requested0223D2BCC   0x0223d60223D4NEGB  0223D6BEQ   0x022430; no move0223D8CMPB  #0x1f; limit 1F0223DABCS   0x0223de0223DCLDAB  #0x1f02240ELDAA  0x810,Z022412CMPA  0x612,Z022418SBA   ; move down02241ASTAA  0x810,Z02241EORAB  #0xa0; direction bits022422ABA   ; move up022424STAA  0x810,Z022428ORAB  #0x2002242AORAB  #0x4002242CJSR   0x022432; queue command 22

FUEL LEVEL INPUT

The fuel level job (0251FC) runs in the slow group. Calibration option 6F8C bit 80 selects the source of the reading. With the bit clear, as in this image, the job reads two values from the companion processor. Command 02, select 1E, returns F863E, the value the DRB reports as fuel level sensor voltage. Command 03, select 1E, returns F8670, the value the job filters.

A value of 97 or above is not filtered. After FF such visits in a row the job sets F8497 bit 40; after 1E visits below that value it clears the bit. While the bit is set the job saves the estimate, marks it FFFF and blends no new readings. When the bit clears and F880A bit 08 is clear, the saved estimate is restored.

The job smooths F8670 with the fractional filter (010048) and converts it through the curve at 214E. The result is stored at F8666 and at F863F, the fuel level percent reported to the DRB. A long-term estimate at F89A0 then follows the curve result through the weighted blend (025424): the old value is multiplied by the weight, the new result is added in the high byte, and the sum is divided by the weight plus one (Fig. 5).

The weight depends on road speed. The job counts consecutive visits at zero road speed in F8665. After 60 stopped visits the estimate blends with weight 9. Below that count, the weight is 300, and a reading that differs from the estimate by 33 or more is not blended.

025336LDD   0x9a0,Z; estimate F89A002533ASUBA  0x666,Z; minus curve result02533EBCC   0x025342025340NEGA  025342BRSET 0x658,Z,#0x40,0x025378025348LDAB  0x665,Z; stopped visits02534CCMPB  0x2148; stopped limit025350BCS   0x025362025352LDE   0x2149; stopped weight025356LDX   0x214902535AAIX   #0x102535CJSR   0x025424; blend025360BRA   0x02538e025362CMPA  0x2147; difference limit025366BCC   0x02538e025368LDE   0x214b; moving weight02536CLDX   0x214b025370AIX   #0x1025372JSR   0x025424025376BRA   0x02538e

025424LDD   0x9a0,Z; estimate025428EMUL  ; times weight02542AADDA  0x666,Z; add result, high byte02542EADCE  #0x0025432EDIV  ; divide by weight + 1025434XGDX  025436STD   0x9a0,Z; new estimate02543ARTS   

CHARGING SYSTEM CHECKS

The software holds the charging target at F8351 and the supply value at F816E. The high-voltage check (019EAA) runs only while the engine runs and the target is nonzero. It returns 80, a failure, when the supply value exceeds the target by 10 or more, and 40, a pass, otherwise (Fig. 6). Its failure result is reported as code 46 (Fig. 11).

The deficit monitor (01AD1E) tests the target minus the supply value, engine speed and inhibit conditions. After its counters run, it sends companion test requests 81 and 82 and reads the response markers 2A and 2B at F8334 to set its result flags.

The battery temperature check (019E0A) tests the raw input at F8352 against 04 and FD. A value outside that range returns a low or high result and sends command 88, select 1E, with the substitute value 60; F848F bit 20 records that the substitute is applied. When the input returns to range, the check sends command 88 with zero and clears the bit. The low and high results are codes P1493 and P1492 (Fig. 12).

019EAATST   0x351,Z; target F8351019EAEBEQ   0x019ece019EB0CLRA  019EB2BRCLR 0xd1,Z,#0x40,0x019ece; engine running019EB8LDAB  0x16e,Z; supply value019EBCSUBB  0x351,Z; minus target019EC0BCS   0x019ecc019EC2CMPB  0x11f6; margin019EC6BCS   0x019ecc019EC8LDAA  #0x80; failure019ECABRA   0x019ece019ECCLDAA  #0x40; pass019ECERTS   

FUEL CORRECTION SUPPORT

Rear oxygen targets. Two medium-group jobs, one per bank (01D386, 01D67E), write the oxygen targets F828E and F828F that the bank 1 and bank 2 fuel trim routines (011DF0, 0128CA) compare against the upstream sensors (3-2 Fuel Feedback). Rear-sensor feedback requires option 270A bit 40 for bank 1 and bit 10 for bank 2. The option byte is A1, so both jobs take their fallback target path. Oxygen heater fault patterns (019B54) set F8880 bit 01, which both rear-target jobs read as an inhibit.

Cylinder-pair inhibit. The slow-group inhibit job (01F874) runs when engine profile option 2707 has bit 02 or 04 set. Each of F880C bits 80, 40, 20, 10 and 08 adds one two-channel mask from ROM 08CE–08D7 to the inhibit word F817B (Fig. 7). The five masks cover all ten fuel channels. The running fuel routine (0109DC) and the starting fuel routine (011B14) test this word against the channel being prepared and set its pulse to zero on a match (3-1 Fuel Amount). The job only adds bits to the word.

Engine-speed drop. The RPM-drop preparation (014076) reads coolant temperature through the curves at 3558 and 357E and engine speed through the curve at 356B. It stores the results at F832A, F832E and F832C. The running fuel routine uses them to scale and cap the fuel term formed from filtered engine speed minus current engine speed (Fig. 9).

01F874LDD   0x17b,Z; inhibit word F817B01F878BRCLR 0x80c,Z,#0xf8,0x01f8ba; any selection01F87EBRCLR 0x2707,#0x6,0x01f8ba; engine profile01F884BRCLR 0x80c,Z,#0x80,0x01f88e01F88AORD   0x8ce; pair 001F88EBRCLR 0x80c,Z,#0x40,0x01f89801F894ORD   0x8d0; pair 101F898BRCLR 0x80c,Z,#0x20,0x01f8a201F89EORD   0x8d2; pair 201F8A2BRCLR 0x80c,Z,#0x10,0x01f8ac01F8A8ORD   0x8d4; pair 301F8ACBRCLR 0x80c,Z,#0x8,0x01f8b601F8B2ORD   0x8d6; pair 401F8B6STD   0x17b,Z; store01F8BARTS   

014076LDAA  0xa6,Z; coolant01407ALDX   #0x3558; curve 355801407EJSR   0x010030014082STAA  0x32a,Z; F832A014086LDAA  0xa6,Z01408ALDX   #0x357e; word curve 357E01408EJSR   0x010034014092STD   0x32e,Z; F832E014096LDAA  0x5a,Z; engine speed01409ALDX   #0x356b; curve 356B01409EJSR   0x0100300140A2STAA  0x32c,Z; F832C0140A6RTS   

STORED STATE SERVICES

Several jobs keep values in the companion processor's memory. A write begins at 018776, which records the source, the 12-bit destination and the length, and sets the busy flag F867E bit 80. The write service (0187A0) streams the source in chunks of up to 16 bytes, accumulates a byte checksum and waits for the status reply at F868A. It resends a chunk when the reply is not recognized.

The radiator fan job also belongs to this group of supporting work; it is described with the other slow-group jobs in 1-5 Scheduled Jobs.

DIAGNOSIS AND TESTING

DRB TESTS AND REPORTS

The DRB idle air tests change the same requested position that normal control uses.

TEST MODE EXPIRY

The slow-group expiry job (01F2E2) ends ISO 9141-2 sessions and actuator tests. While F834E bit 10, the ISO session flag, is set it decrements F834D. At zero it sends command 48, select 1E, with zero, clears the diagnostic state F8345–F834C, waits for the serial transmitter and returns the serial interface to the DRB rate (8-8 Generic OBD Requests). DRB sessions end through a separate inter-byte countdown, F834F, in the fast group (8-7 Scan Tool Commands).

A second countdown at F834C runs while an actuator test is active. With F8128 bit 08 set, expiry clears the bit and calls the actuator dispatch (00CF96). With F8128 bit 04 set, expiry calls the output restoration (00DCAE). While F8128 bit 08 is set, the fan job (01FA22) and the A/C clutch routine (018588) return without changing their requests, so the test keeps control of the output until it expires. The actuator tests are described in 5-1 Output Commands and 8-7 Scan Tool Commands.

DIAGNOSTIC TROUBLE CODES

The service manual lists the following codes for the circuits in this section.

SPECIFICATIONS

Engine speed converts at 32 rpm per count. Supply, input and option values are raw bytes.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

ENGINE POSITION INPUTS

The PCM determines engine position from two inputs. The crankshaft position sensor reads slots cut into a disk on the crankshaft: five sets of two slots, ten slots in all. The camshaft position sensor reads a low and a high machined area on the camshaft drive gear, and its signal switches between approximately 0.3 volts and approximately 5 volts as the areas pass. The PCM determines injector sequence from the camshaft input and ignition timing from the crankshaft input (Fig. 1).

In the software, each engine event enters the capture interrupt routine (028F24). The routine reads the event timestamp, increments the event counter F8054, records a port state byte in F80C5, and reloads the two event watchdogs F80C6 and F80C7 from ROM 2100 and 2101. When the events stop, the watchdogs expire and the PCM retires its running state (2-2 Loss of Engine Events).

The routine then advances the event index F80BD. The index returns to zero after 20 events, the event count of the selected engine profile. The index and timestamp of each indexed event are pushed onto a six-record history at F80E5, which the speed calculation reads. Finally the routine copies the profile's event entry for the new index into F80BC. Each entry is one byte, and each bit requests a piece of work, as listed in the table below.

EVENT SYNCHRONIZATION

The capture routine keeps the event index aligned with the engine using bit 08 of the port state byte. While the index is not synchronized, a change of that bit between two events sets the index directly: to 0 when the bit is clear and to 10 when it is set. The routine then marks the index synchronized (F80CE, bit 20).

Bit 08 of the event entries is clear in entries 0 through 9 and set in entries 10 through 19. After each index update the routine compares the port bit with bit 08 of the new entry. A disagreement outside a recheck clears the synchronized flag, sets the recheck flag F80CA bit 80 and loads the recheck count F80C2 with one less than half the event count.

The first event after a stop takes a separate branch. It clears the event-loss request bits 40 and 80 of F8106 (bit 40 is the request the DRB ASD relay test operates), queues output command 04 and, when the queue allows, fuel-system command 2D with payload 60 (2-2 Loss of Engine Events). The service manual states that the PCM grounds the ASD and fuel pump relays after it receives the camshaft and crankshaft position inputs.

Event entries start at ROM 0718. Entries 4 through 9 repeat entries 0 through 3, and entries 14 through 19 repeat entries 10 through 13.

The even entries request the fuel and spark calculations and the speed calculation, so ten of the twenty events request fuel and spark. The odd entries request the MAP conversion, the event-interval history processing and the interrupt fuel send. Bit 20 alternates from one fuel-send entry to the next, so successive sends alternate between groups A and B.

ENGINE SPEED

The periodic interrupt (028502) calls the engine-speed routine (026CFC) whenever a captured event is waiting. The routine calculates speed at an event whose entry carries bit 04, or at the previous event when maintenance has fallen behind. It subtracts the timestamp recorded 2 events earlier from the newest timestamp, scales the 32-bit profile constant and the elapsed time down together until the time fits in 16 bits, and divides (Fig. 2). The quotient is the engine speed word F805A, in units of 1/8 rpm.

026D62LDE   0x3,Y; newest timestamp026D66SUBE  0x3,X; older timestamp026D6ALDD   0x1,Y026D6CSBCD  0x1,X026D6EANDA  #0xf; period026D82LDE   0x4,X; profile constant026D86LDD   0x6,X026D88TSTW  0x90,Z026D8ELSRE  ; scale down026D90RORD  026D92LSRW  0x90,Z026D96RORW  0x92,Z026D9CLDX   0x92,Z026DA0EDIV  ; divide026DA6STX   0x5a,Z; engine speed F805A

STARTING AND RUNNING PHASES

The same routine maintains the engine phase flags in F80D1 once speed calculation is ready (F80CF, bit 02) and F810B bit 01 is set (Fig. 3).

In the startup-fuel phase (bit 80), engine speed at or above 400 rpm sets the engine-running flag (bit 40) and the running-entry event (bit 01), ends the startup-fuel phase and clears the running timer F8096. Outside the startup-fuel phase, speed below 150 rpm returns it to the startup-fuel phase. That path clears the running flag, clears F80C4 and F80B6, saves the coolant reading F80A6 in F80A7 and stores the result of coolant curve 2721 in F813A.

In the spark-initialization phase (bit 20), speed below 450 rpm reloads the qualification counter F80B7 with 4. At or above that speed each pass decrements the counter. When it reaches zero, the routine sets the post-crank qualified flag (bit 10) and the spark run-up flag (bit 08) and ends the spark-initialization phase. With the phase clear, the routine compares the D register with 04B0. D holds the engine speed word, or the coolant-curve result on a pass that has just returned to the startup-fuel phase. A lower value clears the post-crank qualified flag, restores the spark-initialization phase and sets F80D5 bit 80, so the next spark-initialization command carries FF. The spark modes that follow from these flags are described in 4-1 Spark Timing.

bool viper_engine_run_latch_fragment(uint16_t rpm_word, uint8_t coolant,
                                    const uint8_t cal[11], ViperEngineState *s)
{
    if ((s->flags_d1 & VIPER_STARTUP_FUEL_PHASE) != 0) {
        if (rpm_word >= state_be16(cal)) {
            s->flags_d1 |= VIPER_ENGINE_RUNNING | VIPER_RUN_ENTRY_EVENT;
            s->flags_d1 &= 0x7Fu;
            s->engine_running_timer_96 = 0;
        }
    } else if (rpm_word < state_be16(cal + 2)) {
        s->flags_d1 &= 0xBFu;
        s->flags_d1 |= VIPER_STARTUP_FUEL_PHASE;
        s->transient_c4 = 0;
        s->run_events_b6 = 0;
        s->coolant_at_start_a7 = coolant;
        return true; 
    }
    return false;
}
void viper_post_crank_latch_fragment(uint16_t rpm_word, uint16_t incoming_d_word,
                                    const uint8_t cal[11],
                                    ViperEngineState *s)
{
    if ((s->flags_d1 & VIPER_SPARK_STARTUP_PHASE) != 0) {
        if (rpm_word < state_be16(cal + 4)) {
            s->post_crank_delay_b7 = cal[8];
            return;
        }
        if (s->post_crank_delay_b7 != 0) {
            --s->post_crank_delay_b7;
            if (s->post_crank_delay_b7 != 0) return;
        }
        s->flags_d1 |= VIPER_POST_CRANK_QUALIFIED | VIPER_SPARK_RUNUP_PENDING;
        s->flags_d1 &= 0xDFu;
    } else if (incoming_d_word < state_be16(cal + 6)) {
        s->flags_d1 &= 0xEFu;
        s->flags_d1 |= VIPER_SPARK_STARTUP_PHASE;
        s->flags_d5 |= VIPER_SPARK_INIT_SENTINEL;
    }
}

EVENT WORK REQUESTS

For each waiting event, the engine-speed routine reads the event entry and sets pending-work bits in F80D2 (Fig. 4). The phase flags choose between the startup and the ordinary calculations. The pending-work dispatcher (028992) takes the lowest set bit, clears it, calls its handler through the table at ROM 0478, and scans again until no bit remains. Pending bits combine: one bit can stand for several events.

026E84LDAB  E,IX; event entry026E86BITB  #0x10026E88BEQ   0x026e8e026E8ABSET  0xd2,Z,#0x4; history work026E8EBITB  #0x1026E90BEQ   0x026ea2026E92BRCLR 0xd1,Z,#0x20,0x026e9e; test F80D1.20026E98BSET  0xd2,Z,#0x10; spark initialization026E9CBRA   0x026ea2026E9EBSET  0xd2,Z,#0x2; ordinary spark026EA2BITB  #0x2026EA4BEQ   0x026eb6026EA6BRCLR 0xd1,Z,#0x80,0x026eb2; test F80D1.80026EACBSET  0xd2,Z,#0x8; startup fuel026EB0BRA   0x026eb6026EB2BSET  0xd2,Z,#0x1; ordinary fuel

The fuel calculation stores two prepared values, group A in F82B0 and group B in F82B2. Below 5500 rpm the fuel calculation sends its own command 13. At or above that speed, the capture interrupt sends the prepared value itself on each event whose entry carries bit 40, choosing the group with bit 20. Fuel amount is described in 3-1 Fuel Amount.

FIRING ORDER AND CYLINDER OUTPUTS

At reset (020000) the PCM reads the engine profile selector at ROM 2707. Value 02 selects the V10 profile at ROM 06CA and the fuel mask table at ROM 08BA, and their pointers are saved in F8058 and F8177.

The cylinders are numbered front to rear, 1, 3, 5, 7, 9 on the left bank and 2, 4, 6, 8, 10 on the right bank. The firing order is 1, 10, 9, 4, 3, 6, 5, 8, 7, 2 (Fig. 6). The profile stores this order at ROM 06E4 as cylinder indexes counted from zero (Fig. 7).

The ten fuel-output masks at ROM 08BA follow the same sequence, rotated by one position. The normal and startup fuel calculations index the masks with the fuel cursor F811E and test the selected mask against the fuel inhibit words F8179 and F817B, and a match zeroes the prepared fuel value. The capture routine sets the cursor when it synchronizes the event index and returns it to zero when the index wraps.

The ignition system uses two coil packs: three coils in the left pack fire cylinders 1, 2, 3, 4, 6 and 7, and two coils in the right pack fire cylinders 5, 8, 9 and 10. Each coil fires two cylinders at once, one on its compression stroke and the other on its exhaust stroke (Fig. 9). In the firing order, the two cylinders of one coil are five positions apart: 1 and 6, 10 and 5, 9 and 8, 4 and 7, 3 and 2.

The five cylinder-pair masks at ROM 08CE use the same spacing. Each mask joins two fuel-mask bits that sit five firing positions apart. The inhibit-mask merge (01F874) adds the selected pair masks to the inhibit word F817B; together the five masks cover all ten bits.

DIAGNOSIS AND TESTING

ENGINE POSITION TROUBLE CODES

The service manual lists two trouble codes for the engine position inputs (Fig. 12, Fig. 13). The PCM code catalog at ROM 1222 holds both. Its record number matches the manual's hex code, and each record carries the generic code and the blink code.

Fault reporting is described in 8-2 Fault Reporting.

SPECIFICATIONS

Engine speed words convert at 8 counts per rpm. Firing order 1-10-9-4-3-6-5-8-7-2.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

ENGINE EVENT WATCHDOGS

The PCM confirms that the engine is turning by watching for engine events. Each event enters the engine event capture interrupt (028F24), which records the event timing, marks event activity and reloads two watchdog counters: F80C7 from 80 counts and F80C6 from 73 counts. While events keep arriving, both counters are refilled before they run out (Fig. 1). Engine position and the event pattern are described in 2-1 Engine Position and Timing.

The watchdog check (013E3E) runs in the fast job schedule through 01FCBC, which releases it every 22 scheduler ticks (1-3 Job Scheduling). Counter values are counts of these checks. The two counters expire on different boundaries:

• F80C7, immediate path. Each check decrements a non-zero F80C7. The check that takes it from 1 to 0 performs loss handling at once.
• F80C6, armed path. This path arms only while the engine running flag F80D1.40 is set and the high byte of the runtime word F8096 has reached 4. The check then sets the arm flag F80CE.01. An armed check decrements a non-zero F80C6 and returns. The next armed check that finds F80C6 already at zero performs loss handling.

The readable C in Fig. 2 matches the original instructions in every one of 3,072 checked cases.

RUNNING STATE RETIREMENT

Both expiry paths retire the running state so that other jobs stop treating the engine as turning. Each path clears the engine speed words F805A–F805D, the runtime word F8096 and F817D, clears the running flag F80D1.40 together with F80D1.10, and sets F80D1.80 and F80D1.20. Each path also clears the event state bits F80CE.20 and F80CE.10 and the bits F80CF.02 and F80CF.01.

The paths differ in detail. The immediate path also clears the spark target F83D5, the delivered spark value F83D6 and the final spark value F83D9 (4-1 Spark Timing), and clears F80CF.08 and sets F8847.80 only when F80CE.20 or F80CE.10 was set. The armed path first saves the high byte of F8096 to F899F, clears its own arm flag F80CE.01, and always clears F80CF.08 and sets F8847.80. Both paths then jump to the shared loss output tail at 013DD6.

Because F80CE.10 is cleared, the next engine event is handled as a first event. That branch of the capture interrupt restores the output requests, as described under Recovery.

enum viper_event_result viper_expire_engine_event_watchdogs(uint8_t *r,
                                                          uint8_t threshold)
{
    if (r[0xC7] != 0) {
        uint8_t remaining = (uint8_t)(r[0xC7] - 1);
        if (remaining == 0) {
            r[0x17D] = r[0x96] = r[0x97] = 0;
            if ((r[0xCE] & 0x30) != 0) {
                r[0xCF] &= (uint8_t)~0x08;
                r[0x847] |= 0x80;
            }
            r[0x5A] = r[0x5B] = r[0x5C] = r[0x5D] = 0;
            r[0x3D6] = r[0x3D5] = r[0x3D9] = 0;
            r[0xCE] &= (uint8_t)~0x30;
            r[0xCF] &= (uint8_t)~0x03;
            r[0xD1] = (uint8_t)((r[0xD1] & ~0x50) | 0xA0);
            r[0xC7] = 0;
            return VIPER_EVENT_LOSS_TAIL;
        }
        r[0xC7] = remaining;
    }
    if ((r[0xD1] & 0x40) != 0 && (r[0xCE] & 1) == 0 && r[0x96] >= threshold)
        r[0xCE] |= 1;
    if ((r[0xCE] & 1) == 0)
        return VIPER_EVENT_RETURN;
    if (r[0xC6] != 0) {
        --r[0xC6];
        return VIPER_EVENT_RETURN;
    }
    r[0x99F] = r[0x96];
    r[0x17D] = r[0x96] = r[0x97] = 0;
    r[0x5A] = r[0x5B] = r[0x5C] = r[0x5D] = 0;
    r[0xCE] &= (uint8_t)~0x31;
    r[0xCF] &= (uint8_t)~0x0B;
    r[0xD1] = (uint8_t)((r[0xD1] & ~0x50) | 0xA0);
    r[0x847] |= 0x80;
    return VIPER_EVENT_LOSS_TAIL;
}

LOSS OUTPUT REQUESTS

The service manual states that the Automatic Shutdown (ASD) relay supplies battery voltage to the fuel injectors, ignition coils and oxygen sensor heaters, and that the PCM de-energizes the ASD relay when it does not receive the crankshaft and camshaft position signals with the ignition switch in Run (Fig. 3). With the key on and the engine not running, the ASD and fuel pump relays de-energize after approximately 1 second (Fig. 5).

In the software, the loss output tail at 013DD6 turns the loss into output requests (Fig. 4). If F8106.40 is already set, the loss requests are already in place and the tail returns. Otherwise it sets request bits F8106.80 and F8106.40, sets F848E.20, and sets F8108.04 because ROM 2708 bit 40 is clear in this image (08). It then queues output command 2D with payload 64 and output command 04 carrying the F8106 request byte, and copies F8106 to its shadow F8103 so that the changed-output service (029AFC) does not send it again. When F8541.10 is set, the tail sends command 04 only. When F851E holds EC13 with F8522.04 and F853F.20 set, the tail skips the request bits and sends the two commands directly. The DRB ASD relay test toggles the same bit, F8106.40 (see Diagnosis and Testing). Output commands are described in 5-1 Output Commands.

013D90BRSET 0x128,Z,#0x8,0x013e3c; diagnostic mode013D96BRSET 0x497,Z,#0x80,0x013da8; recovery013D9CBRSET 0xd1,Z,#0x40,0x013da8; running013DA2LDAA  0xc7,Z; F80C7 expired013DA6BEQ   0x013dd6013DD6LDD   0x51e,Z; EC13 test state013DDACPD   #0xec13013DDEBNE   0x013dec013DE0BRCLR 0x522,Z,#0x4,0x013dec013DE6BRSET 0x53f,Z,#0x20,0x013e0a013DECBRSET 0x106,Z,#0x40,0x013e3c; latched013DF2BSET  0x106,Z,#0xc0; set F8106.C0013DF6BSET  0x48e,Z,#0x20013DFABRSET 0x2708,#0x40,0x013e04; ROM 2708.40013E00BSET  0x108,Z,#0x4; set F8108.04013E04BRSET 0x541,Z,#0x10,0x013e1e013E0ALDAB  #0x64; payload 64

SCHEDULED LOSS SERVICE

The event-loss output service (013D90) also runs on its own, every 1953 ticks in the slow job group (1-3 Job Scheduling). It does nothing while the diagnostic-mode bit F8128.08 is set. While the engine running flag F80D1.40 or F8497.80 is set, or while F80C7 is still counting, it enters the recovery gate. When F80D1.40 and F8497.80 are clear and F80C7 has reached zero, it enters the loss output tail. This service keeps the loss requests in force after the watchdogs have expired, and clears them through the recovery gate once F80D1.40 or F8497.80 is set or F80C7 is reloaded.

RECOVERY

Two paths remove the loss requests. The service manual states that the PCM energizes the ASD and fuel pump relays after it receives the camshaft and crankshaft position signals (Fig. 6).

First engine event. When an event arrives with F80CE.10 clear, the capture interrupt sets F80CE.90, clears F8106.40 and F8106.80, and clears F8108.04. It sends output command 04 with F8106 and copies the byte to its shadow. When F80E4 is below 9 it queues command 2D with payload 60, and otherwise it sets F80CC.02. When F80CC.40 is set, it sets F80CC.02 and sends neither command.

Recovery gate. The gate (013DA8) returns at once when F8106.40 is already clear. Otherwise the recovery commands (013DAE) clear F8106.C0 and F8108.04, load F80C7 with 5 so that the immediate watchdog expires again unless events refresh it, queue command 2D with payload 60, and send command 04 with F8106. When F851E holds EC13 with F8522.04 set, the recovery commands skip the F80C7 reload and the command 2D request.

013DAEBCLR  0x106,Z,#0xc0; clear F8106.C0013DB2BRSET 0x2708,#0x40,0x013dbc013DB8BCLR  0x108,Z,#0x4; clear F8108.04013DCCLDAA  #0x5; F80C7 = 5013DCESTAA  0xc7,Z013DD2LDAB  #0x60; payload 60

DIAGNOSIS AND TESTING

DRB OUTPUT TESTS

Three DRB tests operate the same requests and commands as the loss and recovery paths. Each test is reached through the SCI diagnostic table.

DIAGNOSTIC TROUBLE CODES

The service manual lists the following codes for the signals and relay circuits in this section.

Service manual group 25, pages 25-3 to 25-6. Fault reporting is described in 8-2 Fault Reporting.

SPECIFICATIONS

Watchdog counts are counts of watchdog checks.

DESCRIPTION AND OPERATION

FUEL CALCULATION

The PCM controls injector pulse width by switching the ground path to each injector. Engine speed and manifold absolute pressure are the primary inputs that determine pulse width (Fig. 1). The PCM software follows the same plan: a base quantity is read from a speed-by-pressure map, corrected, tested against the fuel-cut requests and handed to the output command path as a raw fuel word (Fig. 2).

Two routines calculate fuel. Each engine event whose profile entry carries bit 02 sets a pending task, and the task dispatcher (028992) runs one of them. While the startup-fuel phase flag F80D1 bit 80 is set, the event schedules the startup fuel routine (011B14). Once the engine-running latch clears that phase, the same event schedules the running fuel routine (0109DC). Engine events and the running latch are described in 2-1 Engine Position and Timing.

The startup routine builds its quantity F82AE from a coolant curve, a pressure correction, a correction against an event counter and a speed correction, then sends it through the same fuel command as the running routine.

BASE FUEL MAP

The running fuel routine converts its two inputs into map coordinates. The engine speed word F805A is rounded to its high byte and normalized through the engine speed axis at ROM 2814 into F8170. The filtered manifold pressure byte F804E is normalized through the pressure axis at ROM 284A into F816F. The word-grid lookup (029EB2) then interpolates the selected map between its four surrounding cells and stores the base fuel word in F82A0 (Fig. 3).

The map holds 17 engine speed rows by 9 pressure columns of 16-bit cells. Interpolation is integer arithmetic: each coordinate is scaled by the table dimension less one, the high byte selects the cell and the low byte is the fraction. Each of the two bounding rows is interpolated and rounded, then the two results are interpolated and rounded again. The lookup method is described in 9-2 Fuel and Starting Tables.

Two base fuel maps are present, A at ROM 2B82 and B at ROM 2CB8. Map B is selected when either bit of mask 14 in F80CB is set and both bits of mask 05 in F880B are clear; otherwise map A is selected. In this calibration the two maps hold identical values, so the selection does not change the base fuel word.

011218LDX   #0x2b82; map A01121CBRCLR 0xcb,Z,#0x14,0x011232; mode bits 14011222BRSET 0x80b,Z,#0x4,0x011232; F880B bit 04011228BRSET 0x80b,Z,#0x1,0x011232; F880B bit 0101122ELDX   #0x2cb8; map B011232LDAA  0x170,Z; speed coordinate011236LDAB  0x16f,Z; pressure coordinate01123AJSR   0x01003c; word grid lookup01123ESTE   0x2a0,Z; base fuel word

FUEL CORRECTIONS

The running routine applies a series of calibrated corrections to the base word. An intake air temperature curve (ROM 2E01) produces F826B. The enrichment grid at ROM 2E4F, indexed by the same speed and pressure coordinates, supplies an enrichment factor; a second enrichment curve against engine speed (ROM 2F11) serves an alternate path. The bank 1 and bank 2 oxygen-feedback routines (011DF0, 0128CA) maintain the short-term and long-term trims. The running routine applies the bank 1 or bank 2 trims according to the active fuel group, F80BC bit 20. Fuel feedback is described in 3-2 Fuel Feedback.

An injector offset is added to the fuel quantity. The fuel timer service (013426) reads the offset curve at ROM 2DEE into F826F, multiplies the result by four and adds the signed base offset at ROM 2B75. The sum saturates at the signed 16-bit limits and is stored in F82B4 (Fig. 5). The running routine adds F82B4 to the fuel quantity. A separate service (01365C) sends the curve byte F826F on select 1D when the command queue has room.

The prepared value is then held at no less than the fuel floor at ROM 2B79 before the fuel-cut gates are tested.

int16_t viper_compute_injector_offset(uint8_t curve_result, int16_t base_offset)
{
    int32_t sum = (int32_t)curve_result * 4 + base_offset;
    if (sum > INT16_MAX) return INT16_MAX;
    if (sum < INT16_MIN) return INT16_MIN;
    return (int16_t)sum;
}

DECELERATION FUEL CUT

During a hard deceleration with a closed throttle, the PCM momentarily turns off the injectors (Fig. 6). The cut-request routine (0134A6) decides when to latch this condition, and the running fuel routine decides when to release it (Fig. 7).

Entry is qualified first. The high byte of the engine-running timer F8096, the pressure value F8804, intake air temperature, the vehicle speed byte and coolant temperature must each be at or above its calibrated minimum. Engine speed must then be strictly above the idle speed target F811C plus the entry margin. The margin is read from the curve at ROM 390E against coolant temperature; refer to Specifications.

When the throttle is off idle (F80D6 bit 80), the routine reloads the entry delay F82D7. At closed throttle, the working fuel word for the active group must be below the entry fuel ceiling and the re-entry lockout F80B3 must be zero. Each qualifying pass then decrements the entry delay. The pass that finds the delay already at zero sets the deceleration cut flag F82D3 bit 10, sets its mirrored request F82D6 bit 10 and loads the hold count F829C (Fig. 8).

While the latch is set, the running fuel routine saves the prepared fuel word and tests three resume conditions: engine speed at or below the idle target plus the resume margin from the curve at ROM 392A, the throttle off idle, or the working fuel word for the active group at or above the resume fuel threshold. Any one condition clears both flags, sets spark flag F80D4 bit 01, reloads the re-entry lockout F80B3 and restores the saved fuel word. Otherwise the fuel word is set to zero for that pass.

A temporary deceleration profile with its own entry and resume curves (ROM 8069 and 8085) is selected by F883B bit 80. The reset routine enables it only when ROM 8068 bit 80 is set; that byte is 00 in this calibration.

bool viper_qualify_decel_cut_fragment(uint8_t throttle_flags, uint8_t group_flags,
    uint16_t fuel_a, uint16_t fuel_b, const ViperFuelCutCalibration *cal,
    ViperFuelCutState *s)
{
    bool alternate = (s->override_flags & 0x80u) != 0;
    uint16_t fuel = (group_flags & 0x20u) != 0 ? fuel_b : fuel_a;
    if ((throttle_flags & 0x80u) != 0) {
        s->entry_delay = alternate ? cal->alternate_entry_delay_reload
                                  : cal->entry_delay_reload;
        return false; 
    }
    if (fuel >= (alternate ? cal->alternate_entry_fuel_limit
                           : cal->entry_fuel_limit) || s->reentry_lockout != 0)
        return false;
    if (s->entry_delay != 0) {
        --s->entry_delay;
        return true; 
    }
    s->flags_d3 |= 0x10u;
    s->requests_d6 |= 0x10u;
    s->hold_29c = cal->hold_reload;
    return true;
}

ENGINE SPEED LIMITS AND FUEL DELIVERY

The same routine maintains two speed-limit requests. The engine speed limit sets F82D3 bit 01 and request F82D6 bit 40 when engine speed exceeds the limit at ROM 3955. While the request is set, the limit is lowered by the release drop at ROM 3953, so the request clears only when speed falls to the lower value. When status bit F8808 bit 20, F8808 bit 40 or F8809 bit 20 is set, the limit is taken from ROM 6009 instead, with the same release drop (Fig. 11).

The combined limit sets F82D3 bit 02 and request F82D6 bit 80 only when engine speed exceeds the limit at ROM 3959 and the filtered road speed word F8135 exceeds the limit at ROM 395B. Both limits drop by their release values while the request is set.

The running fuel routine sets the prepared fuel word to zero whenever F82D3 bit 01 or bit 02 is set, or when external status bit F865E bit 20 or F8584 bit 20 is set. Bit 20 of F80BC selects the group fuel word, F82B0 or F82B2, that receives the result. The other group word receives the same value while its counter (F8296 for F82B0, F8297 for F82B2) is zero; ROM 270D bit 01 suppresses this copy, and that byte is 00 in this calibration. Below the engine speed threshold at ROM 2138, the running routine queues fuel command 13 on select 1D itself. At and above that threshold, the engine-event interrupt (028F24) queues the same command from the stored word of the active group whenever F80BC bit 40 is set. The command queue is described in 5-1 Output Commands. The PCM grounds the ten injector drivers in sequence (Fig. 12).

0135F8BRSET 0x808,Z,#0x20,0x013610; status bits0135FEBRSET 0x809,Z,#0x20,0x013610013604BRSET 0x808,Z,#0x40,0x01361001360ALDD   0x3955; ordinary limit01360EBRA   0x013616013610LDAA  0x6009; status-selected limit013614CLRB  013616BRCLR 0x2d3,Z,#0x1,0x01362401361CSUBD  0x3953; release drop013620BCC   0x013624013622CLRD  013624CPD   0x5a,Z; engine speed013628BCS   0x01363401362ABCLR  0x2d3,Z,#0x1; clear request01362EBCLR  0x2d6,Z,#0x40013632BRA   0x01363c013634BSET  0x2d3,Z,#0x1; set request013638BSET  0x2d6,Z,#0x4001363CRTS   

SPECIFICATIONS

Engine speed words convert at 8 counts per rpm; a single speed byte converts at 32 rpm per count. Temperatures are the stored value minus 64 °C. Fuel words are raw counts.

CALIBRATION STRUCTURES

DESCRIPTION AND OPERATION

CLOSED LOOP FUEL CONTROL

In CLOSED LOOP modes the PCM fine-tunes injector pulse width from the upstream heated oxygen sensor inputs (Fig. 1). The software performs this work in two bank trim routines, one for each cylinder bank: 011DF0 for bank 1 and 0128CA for bank 2. Bank 1 reads its upstream oxygen value from F8038; bank 2 reads F803A.

The fuel pulse width routine (0109DC) calls both trim routines after it has selected the base fuel value (3-1 Fuel Amount). Each call is enabled by a configuration bit in ROM 270A: bit 80 enables the bank 1 routine and bit 20 enables the bank 2 routine (Fig. 2). This calibration stores A1, so both banks run. When RAM flag F8558 bit 10 is set, the bank 2 call also requires ROM 270D bit 40 to be clear; this calibration stores 00 at that address, so the call is always made.