Rom an cf48d

General Information
While there's quite a bit of information out there on how SH70XX ECUs work, Nissans just don't seem to be given much love when it comes to actual tuning information. So instead of focusing solely on ECU functionality, I'm going to focus more on the actual tuning side of things. But obviously you can't tune your ROM if you don't have the maps or knowledge of how the maps interact with one another!  CF48D is a SH705823N ROM from a 2006 Nissan 350z Touring 5AT. This ROM is the most defined Nissan ROM available and will be the ROM being referenced on this page.


 * Current Definition and Definition Template File Can be Found Here -> https://github.com/Pytrex/CF48D

To Do
 * Add to the main page/ROM dissasembly page once it's complete.
 * Add in Nissan MAP Functions (What they do and how to effectively tune them)
 * Formatting
 * Explain Cross Referencing ROMs (Reason why my ROM is more defined than anything Uprev has)
 * Explain General Functions (Like the Ignition Timing thread but focusing more on usefulness than understanding the entire function haha)

Essential Programs

 * WinOLS Demo Version https://www.evc.de/en/download/down_winols.asp
 * ROM Dump from your ROM and from the ROM you’re cross referencing
 * Nissan Definitions (Can use A33B’s or use my updated definition template with 500+ maps found above)
 * (OPTIONAL) Notepad++ https://notepad-plus-plus.org/downloads/ (Go to Plugins Tab -> Plugins Admin and download “XML Tools” and “Npp Xml Treeview”)
 * (OPTIONAL) IDA Pro https://www.hex-rays.com/cgi-bin/quote.cgi (OR other “legitimate” means of gaining access to the software)
 * (OPTIONAL) Ghidra https://ghidra-sre.org/ (Free Variant of IDA Pro in a sense. Funnily enough, it's actually much better than IDA Pro is.)

Nissan Abbreviations
Notes:
 * Should be consistent across all models BUT take precaution as there's always a chance that some are model specific.
 * All of these came from A) Nissan Patents or B)Nissan's Tech Abbreviation List

A/F	Air Fuel Ratio AAQ	Ambient Air Quality ABLS	Active Brake Limited Slip ACC	Accelerator Control System ACCS	Advance Climate Control System ACS 	Auto Cruise Control System ADNVAP	Normalized Throttle Opening Area ADNVPTD	Normalized Opening Area ADV	Final Ignition Timing AFM	Airflow Meter AP	Accelerator Pedal APA	Accelerator Pedal Actuator APO 	Accelerator Opening Degree APOFS  POTENTIALLY- Accelerator Opening Degree Fail-Safe APOFULL	Threshold Opening Degree APP	Accelerator Pedal Position APS	Accelerator Opening Degree ARCON	Air Conditioning Switch ASCD	Automatic Speed Control Device ATVO   Current Throttle Aperture ATC	Automatic Air Conditioner ATDC	After Top Dead Center BARO	Barometric Pressure BPP	Brake Pedal Position BRAKE	Brake Switch CCS	Cruise Control System CDCV	Canister Drain Control Valve CKP	Crankshaftr Position CL	Closed Loop CMP	Camshaft Position CPC	Canister Purge Control CTP	Closed Throttle Positon CVBV	Cut Valve Bypass Valve C-VTC	Continiously Variable Timing Control C-VTC (R/L)	Continious VTS (Right/Left) D1-4	Drive Range 1-4 Gear DTC	Instantaneous Projected Temperature DTCn	Projected Temperature DLTADV Acceleration State (Spark Advance) Correction Value (Coefficient) EBD	Electronic Brake Force Distribution EC	Engine Control (System) ECCS	Electric Concentrated Control System ECL	Engine Coolant Level ECT	Engine Coolant Temperature ECV	Electrical Control Valve EFT	Engine Fuel Temperature EPS	Electronically Controlled Power Steering FC	Fan Control FIC	Fuel Injector Control FP	Fuel Pump FRP	Fuel Rail Pressure FTP	Fuel Tank Pressure FTT 	Fuel Tank Temperature GOV    Idle Ignition Timing (Off throttle=Idle) HA	Heater and Air Con. System HAC	Heater and Air Con. Control System HADV	Knock Correction Value HOSC   Oxygen Storage Amount HOSCMAX Oxygen Storage Amount Maximum Value Hysteresis Delay between input and output in a system upon a change in direction. IA	Intake Air IAC	Idle Air Control IC	Ignition Control IP	Instrument Panel ISC	Idle Speed Control ISS	Input Shaft Speed IVAC	Idle Air Volume Control IVC	Intake Valve Closing Timing IVC	Idle KLMH	Second Limit Value KLMR	First Limit Value KLMRT  Knock Retard Limit // According to A33B KMR	AFR Correction Coefficient KNX	Knock KS	Knock Sensor KTC	Temperature Change Rate KTW	Water Temperature Enrichment Coefficient LADV	Learning Correction Value MADV	Basic Ignition Timing MAP	Manifold Absolute Pressure MAS 	Mass Airflow Sensor MTC 	Manual Air Conditioner Ne	Engine Speed nSET   Target Idle Speed nSET0  Basic Idle Speed OF	Oil Diluting Fuel Quantity OL	Open Loop OSS 	Output Shaft Speed PI Control	Proportional and Integral Control PTD    Powertrain Torque Demand (Control) PS	Desired Wheel Brake Cylinder Pressures Qa 	Intake Air Quantity QH0	Intake Air Flow Ratio RTVO   Real Throttle Aperature Slosh	Fuel moving around causing difficulites getting true pressure rise T*o	Target Output shaft Torque T^o	Estimated Output shaft Torque Ta 	Outside Air Temperature tATVO	Target Throttle Valve Opening Area TC 	Cylinder Wall Temperature TCC	Torque Converter Clutch (Probably) TCH	Temperature Increase Balance Temperature TCn	Cylinder Wall Temperature TCo	Initial Engine Cylinder Wall Temperature Te	Fuel Injection Quantity TFBYA	Target AFR Equivalence Quantity Ti	Fuel Injection Pulse Width TMFR   Fuel Supply Resumption Control Method / A method in which a timer is operated and the fuel injection is resumed TO	Oil Temperature TOn 	Oil Temperature Tp	Base Fuel Injection Quantity TP100  A pulse width corresponding to an amount of air at a charging efficiency of 100% tQH0AP	Intake Air Flow Ratio tQH0LMT	Threshold Flow Ratio tQH0PTD	Target Torque Representative Intake Flow Ratio tQH0TE	Intake Air Flow Ratio TTC	Heat Flow Quantity tTE 	Target Torque tTELMT 	Threshold Torque tTEPTD	Final Target Torque tTVO	Target Throttle Opening Degree TTW	Heat Flow Quantity TVO	Throttle Opening Degree Tw	Engine Cooling Water Temperature VOL	Displacement VTC	Valve Timing Control WSS	Wheel Speed Sensor

=3D Map Tuning=

Target AFR
'''This map is what AFR the ECU will try to achieve in each cell. You'll want to keep the table smooth in order to hit your targets in each cell and not have your AFR be stuck halfway between cells.'''

Not confirmed, but it's possible that setting any of the values to 1 lambda will have the vehicle operate in closed loop mode.

AFR Conversion Table- A direct mV to AFR table. I personally haven't tested this table out, but you could potentially get more accurate readings by adjusting the axis and values to 0-2V instead of 0-4V. Technically if you could get a wideband to hook up to factory harness and be compatible with the stock wideband controller, I believe you could adjust these values to accommodate aftermarket widebands. But even Uprev hasn't tried that yet.

All Timing Maps- The knock window can be added or removed by adding or removing 128 to any cell. So add 128 to whatever cell you want to be included in the knock window or remove 128 from a cell that you don't want to be inside the knock window.

Engine Torque Map- ONLY used in automatic equipped vehicles. Directly affects line pressure for shifting. I've been getting incredible results from this table alone. Shifting faster than my friends RE5 that has a shift kit haha But the axis situation is unfortunate. The axis' are fixed so it gets a filling efficiency %, RPM reading, and scales off of that. So the current axis' from the A2L are a rough estimate. Uprev has this table set up with the cam timing axis' just to try making it easier to understand. But it's hard to tell which one is right. Stock filling up % will never breach 100%. So that makes me think that since this table is scaled off that reading, then wouldn't it be a 0-16 starting at 0% and ending at 100%? Meaning this table should probably follow the cam timing's axis? Just a thought for now. But it would be nice to figure that out because as of right now, 1/3 of the map is useless as you don't have a clue if it's even hitting those cells or not.

QH0 Maps- A literal torque demand map. This directly affects throttle. Raise the values for more throttle opening, lower for less throttle opening. At least in theory. Think of it as more of a throttle open/close request trimming table. The base TVO is based on 2D maps entirely. But this QH0 map acts as a trimming map for those values. This table is more useful for anything but WOT, as throttle will typically always be 100% at WOT. Using an online excel document available on a 370z forum I think, you can very easily set up a calibrated QH0 map. If you raise the values using this tool, I'd recommend going back in and dropped the values in the lower left half of the map as failing to do so causes delayed downshifts in automatics and potentially rev hang in manuals. ''DO NOT ADJUST THIS TABLE IF YOUR THROTTLE TAPERS NEAR REDLINE. THAT IS NORMAL. All Z's have something called throttle cut. It is set about 150rpm before fuel cut. This is intentionally put there so that you'll hit the limiter more gently. This is also what causes automatic Z's to bog instead of bounce off redline. (For V3 TCM's, at least.) So if your throttle tapers you can either move throttle cut closer to rev limiter (at least 100rpm before fuel cut) or remove it entirely.''

Target Drive Force Maps (mMTFDD and such)- These need more testing. But view D as 1 and Ds as 2. So D Range maps are linked (probably need to be set equal or else it'll result in limp mode) and Ds Range maps are linked. So while the Qh0 map is torque request, this is, I guess the target drive force. So it's maybe acting as a base map as well that gets altered by torque requests and such. I have no clue what the difference between the D and Ds one is. Maybe Drive and Manual mode/Sport mode (for vehicles equipped with either)? But it'll result in more or less throttle opening, most likely.

Fuel Cut Tables- Fuel Cut Prohibition Speed is most likely for when fuel cut is absolutely prohibited. Uprev calls it "Fuel Cut Prohibited Table." But the notorious Bosch/JECS, should be simple to figure out if anyone cares to try it out. Theoretically, JECS should be the only one active since JECS/Hitachi made the SH7058 ECU's for the Z I think? But it could be vehicle/ECU dependent.

GOV/GOV3/GOVL Tables- I'm not entirely sure on these three maps functionalities. They're base timing during decel or idle, maybe even both?

Initial Retard Quantity 1->4- These are pretty self explanatory. But why there are so many tables for the same set of values, I dunno. How do these maps work with trimming and such? No clue haha But they're the initial retard values the ECU will follow in whatever circumstances they're triggered.

Ignition Timing Main Constant- Single value in g. Really have no clue what this even means, but I'm presuming it's just referring to a constant in one of the ignition timing equations. What does it represent? No clue.

All Ignition Timing Retard Limiters- There are multiple ignition timing retard limiters. But in testing, the limit still stays at -7 degrees for whatever reason. So disassembly will be needed to figure out which ones are called for and when. I'd highly recommend Ghidra as it makes understanding the code MUCH easier of a task.

Catalyst Temperature (Before/After Activated Judgement) Maps- These 3D maps are presumed to be EGT maps. I'm not sure if it's acting as a translation from O2 voltage, or if it's referenced by the rear O2's to determine catalyst condition. Further investigation would need to be be done. Apart of A2L Function "FTP Catalyst Diagnosis".

PTD On/Off Switchover Step Value Table +Low Speed- This will directly affect ETC performance that's based on torque. It's apart of the function "Target Drive Force ON/OFF switching (main calculation section)" I'm not entirely sure what the axis is either. It's a fixed axis and it could be Nm, N, or something entirely different. No clue how to tune this table either, but it's definitely something that would be useful once we figure out how to utilize it.

TDM Table and Base Torque Table- No clue. Apart of function "Composition of Requirements on Torque Correction (ignition: for MPI)"

Up Shift Limiter (TENG2)- This will only apply for automatic equipped vehicles. This is scaled in Nm, while the axis indicates the gear being shifted to. So 1- Idle/nothing 2-Shifting from 1st to 2nd gear, 3- shifting from 2nd to 3rd gear, 4- shifting from 3rd to 4th gear, 5- shifting from 4th to 5th gear. It's a torque (throttle) cut map. So the higher the values, the more throttle cut occurs. I'm not entirely sure what would be best, but I'm experimenting with it. Theoretically, the less power loss during shifting, the better. But transmission reliability come into play as well. Why is there more torque cut shifting from 2nd to 3rd than from 1st to 2nd? Don't ask me, but Nissan did that for a reason I suppose.

Ignition Timing During Torque Control- I presume this is just the set ignition timing during gear changes. Either the set or the base timing, that is. But more timing will result in less torque cut and less timing will result in more torque cut.

Torque Limiter (Vehicle Speed R/L)- Alex from Uprev stated that it deals with fuel cut at a certain torque point per gear and that it typically only applies to automatic equipped vehicles. I'm thinking this is the fuel cut limiter for mVSPCT speed limiter. Because the regular speed limiter is very gentle, while mVSPCT legitimately cuts fuel. So if engine torque value exceeds the limit, it cuts fuel. It should be based on the Engine Torque map. So it'll be gear dependent for sure due to QH0 %. Which is exactly what I found to be the case in testing. If I was one gear above the lowest possible gear, it wouldn't trigger the limiter. So it'll typically only trigger if you're in the lowest gear for whatever speed you're going.

At Time of Acceleration, AC Cut Judgement VAPO Table- This will directly control when the AC is cut during WOT. Scaling is in presumably TVO degrees. So if you want the AC to cut sooner, you can lower the values. Or if you want to have AC not be cut during WOT, raise them past ~84 degrees.

Full Increase Judgement VAPO Table- Called "Throttle Peg Table" by Uprev. This appears to be the TVO in degrees for determining WOT. SO if TVO exceeds the set values, then the ECU will determine it as WOT. What benefits are there to be gained from this? I don't know to be honest. But if Uprev has it defined, it's important. What's weird is the A2L has it apart of the "Target Equivalent Ratio" functions. I presume those are AFR related, but maybe not? Or maybe WOT will affect fueling different than non-WOT.

TTEPTD Torque Compensation Map- X Axis is scaled in gear ratio (variable, not set) Uprev calls it "Throttle Enhance" Apart of "Calculation of Engine Torque" function as well. From Alex, "The values in the table are lambda or AFR. It's for the powertrain torque demand, so it checks this value last after checking the ETC map 1-5 to make a powertrain decision on how much torque to send across. Personally, I render it based upon the A2L which calls for "compensation percentage" but it can be thought of as an air to fuel ratio compensation percentage, so divide by 100 to get lambda." I feel like further testing is definitely required. A Z1 Tuned Z had these values set to 200% surprisingly. But datalogs showing what exactly it's doing will be needed. Uprev has this inside of their map switching section as well. So it's important enough to be a switchable map!

APOFS Shaft Conversion 1 and 2- Base throttle open-degree tables for APOFS shaft conversion. Accelerator Opening Degree Fail Safe is what I think it stands for. I believe that this is the 1:1 relation throttle map that the ECU will run in the event of some sort of failure. Uprev has ETC disable available that sets the throttle to a 1:1 telation and this would line right up. The issue is whether this acts purely as a failsafe or maybe these also act as the base throttle maps before torque management trims and alters it? https://patents.justia.com/patent/6276333 I'll eventually dig through that and it should tell us just about everything we need to know about throttle control. But it's heavily dependent on torque control.

Accelerator Pedal Full Close Position Learning Initial Value- Exactly what it says. Datalog APS Voltage at idle when the vehicle is fully warmed up to get the value, then just plop it into this table in mV's and boom! It'll make it so at least THAT part of idle relearn will stay constant.

Throttle Full Close Learning Initial mV- Same as above but for the TPS Voltage.

EEPROM Reading/Writing Trial Number of Times- Just two interesting single value maps. Both have a value of 3. Not sure what reading and writing trial stuff is but they have maps haha

mMWTOY and mMYTOW- Before I thought maybe they were throttle 8x8. But after speaking to Alex from Uprev, we were able to determine that they're both EVAP related.

Consult2 CUID- a 20x1 table with three values at the beginning 25 27 128 0 0 0.... Not sure what this map's function is, but I'm guessing it would be treated like the others. I'm wondering if we could maybe alter consult functionality through this? ---

Electronic Throttle Functionality
0005a678 04 bd          _mov.w     @(r0,r11),r4=>vPTDNE          Engine RPM RAM call 0005a67a d6 87          mov.l      DAT_0005a898,r6               = FFFF2506h 0005a67c e0 46          mov        #0x46,r0			  2506+46= tMMTQUPTM 0005a67e 02 6c          mov.b      @(r0,r6),r2=>tMMTQUPTM        M mode rotation synchronous control operation timer RAM call 0005a680 22 28          tst        r2,r2			  Checks if timer is active or not. 0005a682 89 02          bt         LAB_0005a68a	           If the timer is inactive, move to LAB_0005a68a // If the timer is active, Continue

If timer is ACTIVE
0005a684 d6 85          mov.l      ->mQHLMMTUP,r6                Sets "When M mode rotation synchronous control works, QH0 upper limit" to r6        0005a686 a0 4f           bra        LAB_0005a728		  Branches to LAB_0005a728 AFTER running instruction at 0x5a688 0005a688 64 61          _mov.w     @r6=>mQHLMMTUP,r4             Sets "When M mode rotation synchronous control works, QH0 upper limit" value to r4 BEFORE branching to LAB_005a728

If timer is INACTIVE
LAB_0005a68a                                   XREF[1]:     0005a682(j) 0005a68a 96 88          mov.w      DAT_0005a79e,r6                 = 996Dh Sets 9996D to r6         0005a68c 84 62           mov.b      @(0x2,r6)=>wfCLUSW(0x80),r0     Adds 996D and 0x2 to get "State of Clutch Pedal (1=Clutch pedal pressed)" RAM call. Adds to R0. 0005a68e c8 80          tst        #0x80,r0			    Tests if Clutch Pedal is pressed or not. (Bitmask 0x80) 0005a690 89 06          bt         LAB_0005a6a0		     Branches to LAB_005a6a0 if clutch pedal is NOT pressed. //  continues to 0x5a692 if clutch pedal IS pressed.

Clutch Pedal Pressed
0005a692 d2 83          mov.l      PTR_DAT_0005a8a0,r2             = 000089e0 Sets 0x89E0 to R2        0005a694 e6 ff           mov        #-0x1,r6			    Stores data, and sign extends it to r6        0005a696 66 6d           extu.w     r6,r6                           Zero extends value from r6 and stores in r6 bits 16-31 0005a698 64 21          mov.w      @r2=>DAT_000089e0,r4            = FFFFh  Gets value from whatever 0x89E0 is (not in A2L) and sets it to r4        0005a69a 64 4d           extu.w     r4,r4		            Zero extends value from 0x89E0 and stores in r4 bits 16-31 0005a69c 34 60          cmp/eq     r6,r4                           Compares value from 0x89E0 and r6. If values are equal, sets T-bit=1. If values are not equal, sets T-bit=0 0005a69e 8b 43          bf         LAB_0005a728		     Branches to LAB_0005a728 IF T=0, // if T=1, continues to LAB_0005a6a0

LAB_0005a6a0
LAB_0005a6a0                                   XREF[1]:     0005a690(j) 0005a6a0 90 7c          mov.w      DAT_0005a79c,r0                 = 05B6h sets value to r0        0005a6a2 06 bd           mov.w      @(r0,r11),r6=>vPTDNE            Engine RPM RAM call assigned to r6        0005a6a4 62 6d           extu.w     r6,r2			    Zero extends Engine RPM and stores in r2 bits 16-31 0005a6a6 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a6a8 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a6aa e6 ff          mov        #-0x1,r6			    Stores data, and sign extends it to r6        0005a6ac 42 00           shll       r2				    Shifts the content of r2 to the left? 0005a6ae 65 6d          extu.w     r6,r5			    Zero extends r6 and stores in r5 bits 16-31 0005a6b0 32 56          cmp/hi     r5,r2			    Compares r5 to Engine RPM. IF r5>RPM then T-bit=1. IF r5mTQH0LMT,r4=>mTQH0LMT         Sets "QH0 Upper Limit Table" value to r4        0005a6b8 92 72           mov.w      DAT_0005a7a0,r2                 = 71BCh Sets value to r2        0005a6ba 42 0b           jsr        @r2=>FUN_000071bc               Errr. I don't really understand jsr stuff but it runs the command below before branching 0005a6bc 65 5d          _extu.w    r5,r5			    Zero extends r5 and stores in r5 bits 16-31 ( RAN BEFORE JSR to FUN_000071bc) 0005a6be d2 7a          mov.l      ->mfATMT,r2                     = 00008301 Sets Auto/Manual flag to r2        0005a6c0 6e 03           mov        r0,r14                          Sets r0 to r14 0005a6c2 60 20          mov.b      @r2=>mfATMT,r0                  = 18h Sets Auto/Manual Flag to r0        0005a6c4 c8 80           tst        #0x80,r0			    Tests Auto/Manual Flag. If automatic, sets T-Bit to 0. IF manual, sets T-Bit to 1. 0005a6c6 8b 04          bf         LAB_0005a6d2		    Takes branch IF automatic, continues to 0x5a6C8 IF manual.

IF MANUAL; 0005a6c8 96 6b          mov.w      DAT_0005a7a2,r6                 = 84C8h Sets 84c8 to r6        0005a6ca e0 3e           mov        #0x3e,r0			    Sets 0x3e to r0        0005a6cc 02 6d           mov.w      @(r0,r6),r2=>wvHRVSP            84c8+3e = "High Precision Vehicle Speed for PTD" set to r2        0005a6ce a0 15           bra        LAB_0005a6fc		    Branch to LAB_0005a6fc AFTER running following code 0005a6d0 65 2d          _extu.w    r2,r5			    Zero extends r2 value and stores it in r5 bits 16-31 BEFORE branching IF AUTOMATIC; LAB_0005a6d2                                   XREF[1]:     0005a6c6(j) 0005a6d2 92 67          mov.w      DAT_0005a7a4,r2                 = 8444h Sets 8444 to r2        0005a6d4 85 27           mov.w      @(0xe,r2)=>wvVSPX,r0            8444+e= "High Precision Vehicle Speed" set to r0        0005a6d6 65 0d           extu.w     r0,r5		            Zero extends wvVSPX value and sets to r5 bits 16-31 0005a6d8 62 53          mov        r5,r2			    moves r5 value to r2        0005a6da 42 08           shll2      r2				    Shifts the contents of r2 to the left? 0005a6dc 32 5c          add        r5,r2			    Adds r5 to r2        0005a6de 42 08           shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a6e0 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a6e2 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a6e4 42 00          shll       r2			            Shifts the contents of r2 one bit to the left? 0005a6e6 42 11          cmp/pz     r2		                    If r2 is greater than or equal to 0, sets T-Bit to 1. If not, sets T-bit=0. 0005a6e8 8d 03          bt/s       LAB_0005a6f2	            If T-bit=1, takes branch. If T-bit=0, continues. 0005a6ea 65 23          _mov       r2,r5			    Moves r2 value to r5 BEFORE branching. If t-bit=0 0005a6ec e2 ff          mov        #-0x1,r2			    Moves -0x1 to r2        0005a6ee 62 2c           extu.b     r2,r2			    Zero extends r2 and stores value in r2 bits 8-31 0005a6f0 35 2c          add        r2,r5			    Adds r2 value to r5 IF t-bit=1 LAB_0005a6f2                                   XREF[1]:     0005a6e8(j) 0005a6f2 62 53          mov        r5,r2			    Moves r5 to r2        0005a6f4 42 19           shlr8      r2				    Shifts content of r2 8 bits to the right? 0005a6f6 65 29          swap.w     r2,r5			    Swaps the upper and lower parts of the content in r2 and stores it in r5? 0005a6f8 62 5e          exts.b     r5,r2			    Sign extends r5 and stores in r2 0005a6fa 25 2d          xtrct      r2,r5			    Extracts the middle 32 bits from the 64bit content of the linked GR r2,r5 and stores results in r5 IF MANUAL CONTINUED; LAB_0005a6fc                                   XREF[1]:     0005a6ce(j) 0005a6fc 62 53          mov        r5,r2			    Moves r5 to r2        0005a6fe 42 08           shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a700 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a702 42 08          shll2      r2				    Shifts the contents of r2 two bits to the left? 0005a704 e6 ff          mov        #-0x1,r6			    Moves -0x1 to r6        0005a706 42 00           shll       r2				    Shifts the contents of r2 one bit to the left 0005a708 66 6d          extu.w     r6,r6			    Zero extends r6 and stores value in r6 bits 16-31 0005a70a 32 66          cmp/hi     r6,r2			    Compares r6 and r2. Sets T-bit=1 if r2>r6. If r2mTQH0VSP,r4=>mTQH0VSP         Sets "QH0 Upper Limit Speed Table" to r4        0005a712 65 6d           extu.w     r6,r5			    Zero extends r6 and stores value in r5 bits 16-31 0005a714 92 47          mov.w      DAT_0005a7a6,r2                 = 71A4h Sets 71A4 to r2        0005a716 42 0b           jsr        @r2=>FUN_000071a4               int FUN_000071a4 Another jsr function that I have no clue about. Runs instruction below before jumping. 0005a718 6e ed          _extu.w    r14,r14			    Zero extends r14 and stores in r14 bits 16-31 ( RAN BEFORE JSR) 0005a71a 66 0d          extu.w     r0,r6			    Zero extends r0 and stores in r6 bits 16-31 0005a71c 06 e7          mul.l      r14,r6			    Performs 32bit multiplication of r14 and r6. Stores lower 32bits in MACL register? 0005a71e d6 64          mov.l      PTR_DAT_0005a8b0,r6             = 00008000 Sets 0x8000 to r6        0005a720 02 1a           sts        MACL,r2			    Stores MACL value in r2        0005a722 32 6c           add        r6,r2		            Adds r6 value to r2        0005a724 66 29           swap.w     r2,r6			    Swaps the upper and lower parts of the content in r2 and stores it in r6? 0005a726 64 6f          exts.w     r6,r4			    Sign extends contents of r6 to r4.

LAB_0005a728
LAB_0005a728                                   XREF[2]:     0005a686(j), 0005a69e(j) 0005a728 90 3e          mov.w      DAT_0005a7a8,r0                 = 05EAh  Sets 05EA to r0        0005a72a dc 62           mov.l      DAT_0005a8b4,r12                = FFFF241Eh Sets FFFF241E to r12 0005a72c 0b 45          mov.w      r4,@(r0,r11)=>vQH0LMT           Sets "QH0 Upper Limit Value" to (r0,r11)??? Not sure how this one works. 0005a72e 90 3c          mov.w      DAT_0005a7aa,r0                 = 08B0h 0005a730 dd 61          mov.l      DAT_0005a8b8,r13                = FFFF23B6h 0005a732 05 bd          mov.w      @(r0,r11),r5=>vTQH0TE           Sets "Torque Qh0 Conversion Value" to r5        0005a734 84 c2           mov.b      @(0x2,r12)=>fFDTLIN(0x40),r0    Sets 0xFF2420 to r0        0005a736 6e 03           mov        r0,r14			    Moves r0 value to r14 0005a738 62 03          mov        r0,r2			    Moves r0 value to r2        0005a73a e0 1e           mov        #0x1e,r0			    Moves 0x1e to r0        0005a73c 07 dc           mov.b      @(r0,r13),r7=>fFRVSP(0x2)	    fFRVSP set to r7        0005a73e 60 73           mov        r7,r0		            r7 set to r0        0005a740 c8 02           tst        #0x2,r0			    Tests fFRVSP "Hysteresis Flag" If value 0 Sets T-bit=1. if value nonzero, sets T-bit=0. 0005a742 8d 04          bt/s       LAB_0005a74e		    Branches to LAB_0005a74e IF T-bit=1. Continues code IF T-bit=0 0005a744 65 5d          _extu.w    r5,r5			    Zero extends r5 value to r5 bits 16-31 (BEFORE BRANCHING TO LAB_0005a74e) IF T-bit=0; 0005a746 d3 5d          mov.l      ->mDQH0LMT,r3 0005a748 66 31          mov.w      @r3=>mDQH0LMT,r6		    Sets "QH0 Upper Limit Judgement Hysteresis" to r6        0005a74a 66 6d           extu.w     r6,r6			    Zero extends r6 to r6 bits 16-31 0005a74c 35 6c          add        r6,r5			    Adds r6 to r5 IF T-bit=1; LAB_0005a74e                                   XREF[1]:     0005a742(j) 0005a74e 64 4d          extu.w     r4,r4			    Zero extends r6 to r6 bits 16-31 0005a750 60 73          mov        r7,r0			    Moves r7 to r0        0005a752 35 42           cmp/hs     r4,r5			    Compares r4 to r5. If r5 is greater than or equal to r4, set T-bit=1. IF not, sets T-bit=0. 0005a754 8d 01          bt/s       LAB_0005a75a		    Branches to LAB_0005a75a IF T-bit=1. Continues code IF T-bit=0 (RUNS FOLLOWING CODE FIRST) 0005a756 cb 02          _or        #0x2,r0			    "ORs the contents of r0 and the zero extended immediate value, stores in r0" BEFORE BRANCHING

IF t-bit=0; 0005a758 c9 fd          and        #0xfd,r0			    "ANDs the contents of r0 and the zero extended immediate value, stores in r0" IF T-bit=1; LAB_0005a75a                                   XREF[1]:     0005a754(j) 0005a75a 66 03          mov        r0,r6			    Moves r0 data to r6        0005a75c e0 1e           mov        #0x1e,r0			    Stores immediate data sign extended to longword in r0        0005a75e 0d 64           mov.b      r6,@(r0,r13)=>fFRVSP(0x2) 0005a760 e7 ff          mov        #-0x1,r7			    Stores immediate data sign extended to longword in r7        0005a762 d6 57           mov.l      ->mAPOFULL,r6                   = 00008720 Sets 8720 to r6        0005a764 67 7d           extu.w     r7,r7			    Zero extends r7 to r7 bits 16-31 0005a766 65 61          mov.w      @r6=>mAPOFULL,r5                Sets "Accelerator Full-Open Threshold" to r5        0005a768 65 5d           extu.w     r5,r5			    Zero extends r5 to r5 bits 16-31 0005a76a 35 70          cmp/eq     r7,r5			    Compares r7 and mAPOFULL, sets T-bit=1 if equal. T-bit=0 if not. 0005a76c 89 0e          bt         LAB_0005a78c		    Takes branch LAB_0005a78c if T-bit=1, doesn't if T-bit=0 IF T-bit=0; 0005a76e d7 55          mov.l      DAT_0005a8c4,r7                 = FFFF1000h Sets 0xFF1000 to r7        0005a770 85 74           mov.w      @(offset DAT_ffff1008,r7),r0 0005a772 66 0d          extu.w     r0,r6			    Zero extends r0 to r6 bits 16-31 0005a774 60 23          mov        r2,r0			    Moves r2 value to r0        0005a776 c8 40           tst        #0x40,r0			    Tests whatever value r0 is. T-bit=1 if values are 0. T-bit=0 if values are nonzero. 0005a778 89 03          bt         LAB_0005a782		    Takes branch LAB_0005a782 if T-bit=1, doesn't if T-bit=0 IF T-bit=0; 0005a77a d7 53          mov.l      ->mDAPOFULL,r7                  = 0000877e Sets 877e to r7        0005a77c 62 71           mov.w      @r7=>mDAPOFULL,r2		    Sets "Accelerator full-open judgement hysteresis" to r2        0005a77e 62 2d           extu.w     r2,r2			    Zero extends r2 to r2 bits 16-31 0005a780 36 2c          add        r2,r6			    Adds "Accelerator full-open judgement hysteresis" to r6 IF T-bit=1; LAB_0005a782                                   XREF[1]:     0005a778(j) 0005a782 36 52          cmp/hs     r5,r6			    Compares r5, r6. If r6>r5, sets T-bit=1. If r5>r6, sets T-bit=0. 0005a784 8f 13          bf/s       LAB_0005a7ae		    If T-bit=0, takes branch to LAB_0005a7ae. If not, continues instruction. IF T-bit=1 0005a786 60 e3          _mov       r14,r0			    Moves r14 to r0        0005a788 a0 06           bra        LAB_0005a798	            Branches to LAB_0005a798 0005a78a 00 09          _nop					    No operation. (Ran before branching) IF T-bit=1; LAB_0005a78c                                   XREF[1]:     0005a76c(j) 0005a78c 90 0e          mov.w      DAT_0005a7ac,r0                 = 08A6h Sets 8A6 to r0        0005a78e 05 bd           mov.w      @(r0,r11),r5=>vTQH0AP           Sets "APO/QH0 Conversion Value" to r5        0005a790 65 5d           extu.w     r5,r5			    Zero extends r5 to r5 bits 16-31 0005a792 35 43          cmp/ge     r4,r5			    Compares r4,r5. If r5 is greater than or equal to r4, sets T-bit=1. if not, sets T-bit=0. 0005a794 8f 0b          bf/s       LAB_0005a7ae		    Branches to LAB_0005a7ae IF T-bit=0. If not, continues instruction. 0005a796 60 23          _mov       r2,r0			    Moves r2 to r0 (RUNS BEFORE BRANCHING. Also is ran even if it doesn't branch) LAB_0005a798                                   XREF[1]:     0005a788(j) 0005a798 a0 0a          bra        LAB_0005a7b0	            Branches to LAB_0005a7b0 0005a79a cb 40          _or        #0x40,r0		            "ORs the contents of r0 and the zero extended immediate value, stores in r0" BEFORE BRANCHING

IF T-bit=0; LAB_0005a7ae                                   XREF[2]:     0005a784(j), 0005a794(j) 0005a7ae c9 bf          and        #0xbf,r0			    "ANDs the contents of r0 and the zero extended immediate value, stores in r0" LAB_0005a7b0                                   XREF[1]:     0005a798(j) 0005a7b0 d2 46          mov.l      ->mfECVT(0x80),r2               = 00007f40 Sets 7f40 to r2        0005a7b2 80 c2           mov.b      r0,@(0x2,r12)=>fFDTLIN(0x40) 0005a7b4 60 20          mov.b      @r2=>mfECVT(0x80),r0            = 44h Sets "CVT Car Choice Flag" to r0        0005a7b6 c8 80           tst        #0x80,r0			    Tests if vehicle is CVT equipped or not. IF non-CVT, T-bit=1. IF CVT, T-bit=0. 0005a7b8 89 5b          bt         LAB_0005a872		    Takes branch if T-bit=1, doesn't if t-bit=0.

IF CVT EQUIPPED VEHICLE; I'm gonna be honest. I'm not going to define any of this for CVTs. No one tunes CVTs and no one really needs to know the in depths of throttle control for CVT equipped vehicles as there's hardly any tuning potential. Just adjust QH0 maps for throttle tuning.

IF NON-CVT EQUIPPED; LAB_0005a872                                   XREF[1]:     0005a7b8(j) 0005a872 e0 1e          mov        #0x1e,r0					     Stores immediate data sign extended to longword in r0        0005a874 d7 16           mov.l      ->Target-Basis-QH0-Table,r7=>Target-Basis-QH0-   = 0000d216  Sets Target Basis Qh0 Table value to r7                                                                                             = "" 0005a876 00 dc          mov.b      @(r0,r13),r0=>fFRVSP(0x2)			     Sets "Hysteresis Flag" to r0 0005a878 c8 02          tst        #0x2,r0					     Tests Hysteresis Flag. If 0 value, T-bit=1. IF nonzero, T-bit=0. // If flag is triggered, T-bit=0. If flag is not triggered, T-bit=1. 0005a87a 89 35          bt         LAB_0005a8e8				     Branches to LAB_0005a8e8 IF t-bit=1. Continues code IF t-bit=0. IF T-bit=0; 0005a87c 84 c2          mov.b      @(0x2,r12)=>fFDTLIN(0x40),r0		     Sets "Lockup permission signal output control condition formation flag" to r0        0005a87e c8 40           tst        #0x40,r0					     Test r0. If 0, T-bit=1. If nonzero, T-bit=0. 0005a880 89 32          bt         LAB_0005a8e8				     Branches to LAB_005a8e8 if T-bit=1. Not if t-bit=0. IF T-bit=0; 0005a882 90 02          mov.w      DAT_0005a88a,r0                                  = 08A6h Sets 8A6 to r0        0005a884 a0 39           bra        LAB_0005a8fa				     Branches to LAB_0005a8fa 0005a886 06 bd          _mov.w     @(r0,r11),r6=>vTQH0AP                            Sets "APO/QH0 conversion value" to r6 (BEFORE BRANCHING)

IF T-bit=1; LAB_0005a8e8                                   XREF[2]:     0005a87a(j), 0005a880(j) 0005a8e8 90 b3          mov.w      DAT_0005aa52,r0                                  = 05EAh Sets 5EA to r0        0005a8ea 04 bd           mov.w      @(r0,r11),r4=>vQH0LMT                            Sets "QH0 Upper Limit Value" to r4        0005a8ec 90 b2           mov.w      DAT_0005aa54,r0                                  = 08B0h Moves 8B0 to r0        0005a8ee 64 4d           extu.w     r4,r4                                            Zero extends r4 and stores the results in r4 bits 16-31 0005a8f0 05 bd          mov.w      @(r0,r11),r5=>vTQH0TE                            Sets "Torque QH0 conversion value" to r5        0005a8f2 66 5d           extu.w     r5,r6                                            Zero extends r5 and stores the results in r6 bits 16-31 0005a8f4 34 67          cmp/gt     r6,r4                                            Compares r6,r4. If r4(vQH0LMT) is greater than r6(vTQH0TE), T-bit=1. If not, T-bit=0. 0005a8f6 89 00          bt         LAB_0005a8fa                                     Branch to LAB_0005a8fa IF T-bit=1. If not, continue with code.

IF T-bit=0; 0005a8f8 66 43          mov        r4,r6                                            Move r4 to r6. If T-bit=1; Branched from 0x5a884; LAB_0005a8fa                                   XREF[2]:     0005a884(j), 0005a8f6(j) 0005a8fa 90 ac          mov.w      DAT_0005aa56,r0                                  = 08ACh Adds 8AC to r0        0005a8fc 0b 65           mov.w      r6,@(r0,r11)=>vTQH0PTD                           READS? "PTD basic volume flow-quantity ratio" ? / Moves value to r6       0005a8fe e0 3e           mov        #0x3e,r0					     Stores immediate data sign extended to longword in r0        0005a900 02 7d           mov.w      @(r0,r7),r2=>DAT_0000d254                        = FC00h 0005a902 66 6d          extu.w     r6,r6                                            Zero extends r6 and stores the results in r6 bits 16-31 0005a904 62 2d          extu.w     r2,r2                                            Zero extends r2 and stores the results in r2 bits 16-31 0005a906 36 23          cmp/ge     r2,r6                                            Compares r2,r6. If r6>r2, set T-bit=1. If not, T-bit=0. 0005a908 89 05          bt         LAB_0005a916                                     Branch to LAB_0005a916 IF T-bit=1. If not, continue code.

IF T-bit=0; 0005a90a d4 8e          mov.l      ->Axis_mTTGADNV,r4=>Axis_mTTGADNV                = 0000d106 Axis address 0005a90c 92 a4          mov.w      DAT_0005aa58,r2                                  = 72ECh Adds 72EC to r2        0005a90e 42 0b           jsr        @r2=>FUN_000072ec                                undefined FUN_000072ec(undefined        0005a910 65 73           _mov       r7=>Target-Basis-QH0-Table,r5                    = "" Calls value from Target Basis QH0 Table        0005a912 a0 08           bra        LAB_0005a926                                     Branch to LAB_0005a926 AFTER running following code        0005a914 66 0d           _extu.w    r0,r6                                            Zero extends r0 and stores the results in r6 bits 16-31 IF T-bit=1;                             LAB_0005a916                                    XREF[1]:     0005a908(j)          0005a916 d4 8c           mov.l      ->Axis_mTTGADNVH,r4=>Axis_mTTGADNVH              = 0Bh                                                                                             = 0000d146 AXIS 0005a918 d5 8c          mov.l      ->Target-Basis-QH0-Table2,r5=>Target-Basis-QH0   = FCh = 0000d256 Moves Target Basis Qh0 Table value to r5       0005a91a 92 9d           mov.w      DAT_0005aa58,r2                                  = 72ECh Moves 72EC to r2        0005a91c 42 0b           jsr        @r2=>FUN_000072ec                                undefined FUN_000072ec(undefined        0005a91e 00 09           _nop        0005a920 66 0d           extu.w     r0,r6                                            Zero extends r0 and stores the results in r6 bits 16-31        0005a922 46 08           shll2      r6				                     Shifts the contents of r6 two bits to the left?        0005a924 46 08           shll2      r6				                     Shifts the contents of r6 two bits to the left?                             LAB_0005a926                                    XREF[1]:     0005a912(j) 0005a926 e0 07          mov        #0x7,r0					     Stores immediate data sign extended to longword in r0        0005a928 d7 89           mov.l      ->Engine-Displacement,r7                         = 0000851d Moves Engine Displacement Address to R7        0005a92a 40 18           shll8      r0                                               Shifts the contents of r0 8 bits to the left. 0005a92c 0b 66          mov.l      r6,@(r0,r11)=>vTADNVTE                         Moves PTD normalized opening are to???? 0005a92e 90 94          mov.w      DAT_0005aa5a,r0                                  = 05B6h 0005a930 64 70          mov.b      @r7=>Engine-Displacement,r4                      = 8Ch Moves Engine Displacement Value to r4        0005a932 02 bd           mov.w      @(r0,r11),r2=>vPTDNE                           Moves engine RPM to r2        0005a934 64 4c           extu.b     r4,r4                                          Zero extends r4 and stores the results in r4 bits 8-31 0005a936 65 2d          extu.w     r2,r5                                          Zero extends r2 and stores the results in r5 bits 16-31 0005a938 05 67          mul.l      r6,r5                                          Performs 32bit multiplication of r6,r5. Stores the lower 32bits in the MACL register. 0005a93a d5 86          mov.l      PTR_DAT_0005ab54,r5                            = 00008000 Moves 8000 to r5        0005a93c 06 1a           sts        MACL,r6                                        "Stores system register MACL in the destination" 0005a93e 46 09          shlr2      r6                                             Shift contents of r6 16 bits to the right and stores results in r6        0005a940 62 6d           extu.w     r6,r2                                          Zero extends r6 and stores the results in r2 bits 16-31 0005a942 04 27          mul.l      r2,r4                                          Performs 32bit multiplication of r2,r4. Stores the lower 32bits in the MACL register. 0005a944 02 1a          sts        MACL,r2                                        "Stores system register MACL in the destination" 0005a946 32 5c          add        r5,r2                                          Add r5 to r2        0005a948 65 63           mov        r6,r5                                          Move r6 to r5        0005a94a 45 29           shlr16     r5                                             Shift contents of r5 16 bits to the right and stores results in r5        0005a94c 04 57           mul.l      r5,r4                                          Performs 32bit multiplication of r5,r4. Stores the lower 32bits in the MACL register. 0005a94e d5 82          mov.l      ->Target-TVO-Conversion-Table,r5               = 0000c4b0 Moves Target TVO Conversion Table address to r5        0005a950 42 29           shlr16     r2                                             Shift contents of r2 16 bits to the right and stores results in r2        0005a952 06 1a           sts        MACL,r6                                        "Stores system register MACL in the destination" 0005a954 32 6c          add        r6,r2                                          Add r6 to r2         0005a956 66 51           mov.w      @r5=>Target-TVO-Conversion-Table,r6            = 0058h Move Target TVO Conversion Table Value to r6        0005a958 66 6d           extu.w     r6,r6                                          Zero extends r6 and stores the results in r6 bits 16-31 0005a95a 32 62          cmp/hs     r6,r2                                          Compares r6,r2. If r2>r6, T-bit=1. IF not, T-bit=0. 0005a95c 8b 00          bf         LAB_0005a960                                   Branch to LAB_0005a960 IF T-bit=0. If not, continue code.

IF T-bit=1; 0005a95e 66 23          mov        r2,r6                                          Moves r2 to r6 IF T-bit=0; LAB_0005a960                                   XREF[1]:     0005a95c(j) 0005a960 62 63          mov        r6,r2                                          Moves r6 to r2        0005a962 d6 7e           mov.l      ->mfPTD_ON(0x1),r6                             = 000081d5 Sets 81d5 to r6        0005a964 60 60           mov.b      @r6=>mfPTD_ON(0x1),r0                          mfTTE_ON for 0x40 Torque TTE control choice flag 0005a966 c8 40          tst        #0x40,r0                                       Tests "Torque TTE control choice flag" If 0, T-bit=1. If nonzero, T-bit=0. 0005a968 8b 01          bf         LAB_0005a96e                                   Take branch IF t-bit=0. If not, follow code.

IF T-bit=1; 0005a96a c5 0a          mov.w      @(0x14,GBR)=>vAAPO,r0                          Moves "Accelerator Opening Area" to r0. 0005a96c 62 0d          extu.w     r0,r2                                          Zero extends r0 and stores the results in r2 bits 16-31 IF T-bit=0; LAB_0005a96e                                   XREF[1]:     0005a968(j) 0005a96e e6 ff          mov        #-0x1,r6					   Stores immediate data sign extended to longword in r0        0005a970 66 6d           extu.w     r6,r6                                          Zero extends r6 and stores the results in r6 bits 16-31 0005a972 32 66          cmp/hi     r6,r2                                          Compares r6,r2. If r2>r6, T-bit=1. If not, T-bit=0. 0005a974 89 00          bt         LAB_0005a978                                   Takes branch LAB_0005a978 IF T-bit=1. If not, continue code.

IF T-bit=0; 0005a976 66 23          mov        r2,r6				           Moves r2 to r6 IF T-bit=1; LAB_0005a978                                   XREF[1]:     0005a974(j) 0005a978 90 70          mov.w      DAT_0005aa5c,r0=>LAB_00000710                  = 0710h Sets 710 to r0         0005a97a 0b 65           mov.w      r6,@(r0,r11)=>vTATE				   Sets the "PTD torque area conversion value" 0005a97c 4f 17          ldc.l      @r15+,GBR 0005a97e 4f 16          lds.l      @r15+,MACL 0005a980 4f 26          lds.l      @r15+,PR 0005a982 6e f6          mov.l      @r15+,r14 0005a984 6d f6          mov.l      @r15+,r13 0005a986 6c f6          mov.l      @r15+,r12 0005a988 00 0b          rts 0005a98a 6b f6          _mov.l     @r15+,r11