DTC Tables

[Casey]

There are three main tables of interest for your DTC/SES
options. This format is used on all of the code I have seen from several model/year combinations.




First Table

ROM:0002B398 ;-------------------------------------------------------------------------------------
ROM:0002B398 ;
ROM:0002B398 ; DIAGNOSTIC TROUBLE CODE DEFINITIONS
ROM:0002B398 ;
ROM:0002B398 ; Lookup Location = Table start location + (entry value X 4)
ROM:0002B398 ;-------------------------------------------------------------------------------------
ROM:0002B398 DTC_P000_Words_Index:dc.w 0 ;
ROM:0002B398 ;
ROM:0002B39A DTC_Ram_Location_Index:dc.b 0 ;
ROM:0002B39A ;
ROM:0002B39B Option_byte_2B39B:dc.b 0 ;
ROM:0002B39C dc.w $101 ; Mass Air Flow (MAF) Sensor Performance
ROM:0002B39E dc.b 2
ROM:0002B39F dc.b 1
ROM:0002B3A0 dc.w $102 ; Mass Air Flow (MAF) Sensor Circuit Low Frequency
ROM:0002B3A2 dc.b 2
ROM:0002B3A3 dc.b 1
ROM:0002B3A4 dc.w $103 ; Mass Air Flow (MAF) Sensor Circuit High Frequency
ROM:0002B3A6 dc.b 2
ROM:0002B3A7 dc.b 1
ROM:0002B3A8 dc.w $106 ; Manifold Absolute Pressure (MAP) System Performance
ROM:0002B3AA dc.b $13
ROM:0002B3AB dc.b 1
ROM:0002B3AC dc.w $107 ; Manifold Absolute Pressure (MAP) Sensor Circuit Low Voltage
ROM:0002B3AE dc.b $13
ROM:0002B3AF dc.b 1
ROM:0002B3B0 dc.w $108 ; Manifold Absolute Pressure (MAP) Sensor Circuit High Voltage
ROM:0002B3B2 dc.b $13
ROM:0002B3B3 dc.b 1
ROM:0002B3B4 dc.w $111 ; Intake Air Temperature (IAT) Sensor Performance
ROM:0002B3B6 dc.b $14
ROM:0002B3B7 dc.b 1
ROM:0002B3B8 dc.w $112 ; Intake Air Temperature (IAT) Sensor Circuit Low Voltage
ROM:0002B3BA dc.b $14
ROM:0002B3BB dc.b 1
ROM:0002B3BC dc.w $113 ; Intake Air Temperature (IAT) Sensor Circuit High Voltage
ETC............




Second Table

ROM:00076934 ;-------------------------------------------------------------------------------------
ROM:00076934 ; Engine Diagnostics Error Mode Option Bytes
ROM:00076934 ;
ROM:00076934 ; 0 = Type "A"
ROM:00076934 ; Emissions related. Illuminates MIL the first time DTC sets.
ROM:00076934 ;
ROM:00076934 ; 1 = Type "B"
ROM:00076934 ; Emissions related. Illuminates MIL if fault is active for 2 consecutive driving cycles.
ROM:00076934 ;
ROM:00076934 ; 2 = Type "C"
ROM:00076934 ; Non-emissions related. Does not illuminate MIL, but will illuminate SERVICE light.
ROM:00076934 ;
ROM:00076934 ; 3 = Type "D"
ROM:00076934 ; Non-emissions related. Does not illuminate MIL or SERVICE light.
ROM:00076934 ;
ROM:00076934 ; Location = Table base address + entry value
ROM:00076934 ;
ROM:00076934 ;-------------------------------------------------------------------------------------
ROM:00076934 DTC_Options: dc.b 3 ;
ROM:00076934 ;
ROM:00076935 dc.b 0 ; P0101 Mass Air Flow (MAF) Sensor Performance
ROM:00076936 dc.b 0 ; P0102 Mass Air Flow (MAF) Sensor Circuit Low Frequency
ROM:00076937 dc.b 0 ; P0103 Mass Air Flow (MAF) Sensor Circuit High Frequency
ROM:00076938 dc.b 3 ; P0106 Manifold Absolute Pressure (MAP) System Performance
ROM:00076939 dc.b 1 ; P0107 Manifold Absolute Pressure (MAP) Sensor Circuit Low Voltage
ROM:0007693A dc.b 1 ; P0108 Manifold Absolute Pressure (MAP) Sensor Circuit High Voltage
ROM:0007693B dc.b 3 ; P0111 Intake Air Temperature (IAT) Sensor Performance
ROM:0007693C dc.b 1 ; P0112 Intake Air Temperature (IAT) Sensor Circuit Low Voltage
ROM:0007693D dc.b 1 ; P0113 Intake Air Temperature (IAT) Sensor Circuit High Voltage
ECT................



Third Table

ROM:000769FE ;-------------------------------------------------------------------------------------
ROM:000769FE ; Engine Diagnostics SES Option Flags
ROM:000769FE ;
ROM:000769FE ; 0 = Disabled
ROM:000769FE ; 1 = Enabled
ROM:000769FE ;
ROM:000769FE ; Location = Table base address + entry value
ROM:000769FE ;-------------------------------------------------------------------------------------
ROM:000769FE DTC_SES_Flags: dc.b 0 ;
ROM:000769FE ;
ROM:000769FF dc.b 1 ; P0101 Mass Air Flow (MAF) Sensor Performance
ROM:00076A00 dc.b 1 ; P0102 Mass Air Flow (MAF) Sensor Circuit Low Frequency
ROM:00076A01 dc.b 1 ; P0103 Mass Air Flow (MAF) Sensor Circuit High Frequency
ROM:00076A02 dc.b 0 ; P0106 Manifold Absolute Pressure (MAP) System Performance
ROM:00076A03 dc.b 1 ; P0107 Manifold Absolute Pressure (MAP) Sensor Circuit Low Voltage
ROM:00076A04 dc.b 1 ; P0108 Manifold Absolute Pressure (MAP) Sensor Circuit High Voltage
ROM:00076A05 dc.b 0 ; P0111 Intake Air Temperature (IAT) Sensor Performance
ROM:00076A06 dc.b 1 ; P0112 Intake Air Temperature (IAT) Sensor Circuit Low Voltage
ROM:00076A07 dc.b 1 ; P0113 Intake Air Temperature (IAT) Sensor Circuit High Voltage
ETC...................











The DTC Options table will be called in your DTC set and DTC clear routines.

A typical call to the DTC set routine will include the table offset address.

ROM:000205DA moveq #$A,d0 <<<-----(#$A is the offset for ETC sensor P0117)
ROM:000205DC jsr DTC_Set ; P0117 Engine Coolant Temperature (ECT) Sensor Circuit Low Voltage


ROM:000251B4 moveq #3,d0 <<<----( #3 is the offset for MAF P0103)
ROM:000251B6 jsr DTC_Set ; P0103 Mass Air Flow (MAF) Sensor Circuit High Frequency





The exception to this is an index variable call before the DTC set routine.

From here you can trace all of the engine values back to their origins.

There are other error mask tables, but these will be of most interest to you.

Enjoy


Super Sport x2

[lndshrk]

Super_Sport,

A note would be that in the "segmented" binaries, the
ones that are 8 separately checksummed areas, which
I believe are the 1999's and later..

The DTC_Options and DTC_SES_Flags tables are
usually located in the Engine_Diagnostics sections.

(aka the "third section&quot

Also, in my '03 Z06, there is a third table that controls
not the setting of "individual DTC's" but all DTC's related
to a specific system. Example: the MAF system byte
controls DTC's P0101, 0102, and 0103/etc

You can find this table by tracing back the DTC setting
calls to a routine that calls all the different DTC routines
one-by-one:

Looks like this:

ROM:000298C0 loc_298C0: ; CODE XREF: sub_2987A+3Ej
ROM:000298C0 tst.b ($FFFF9F00).w
ROM:000298C4 beq.s loc_298D8
ROM:000298C6 jsr Check_P0102_P0103
ROM:000298CC jsr sub_64D62
ROM:000298D2 jsr Check_P0101
ROM:000298D8
ROM:000298D8 loc_298D8: ; CODE XREF: sub_2987A+4Aj
ROM:000298D8 tst.b ($FFFF9EF1).w
ROM:000298DC beq.s loc_298E4
ROM:000298DE jsr sub_60454
ROM:000298E4
ROM:000298E4 loc_298E4: ; CODE XREF: sub_2987A+62j

See the $FFFF9F00 byte?

In reality of course $FF9F00 in processor RAM.

That's the HFM system enable/disable diag byte.

It's loaded from FLASH thusly:

ROM:000279D6 lea (byte_14020).l,a3
ROM:000279DC lea ($FFFF9EDE).w,a2
ROM:000279E0 moveq #$23,d0 ; '#'
ROM:000279E2
ROM:000279E2 loc_279E2: ; CODE XREF: ROM:000279E4j
ROM:000279E2 move.w (a3)+,(a2)+
ROM:000279E4 dbf d0,loc_279E2

Note that 35 words (or 75 bytes, each capable of
controlling a "system) are loaded into 35 sequential
word registers.

The "load from" address is again located in the
Engine_Diagnostics section of segmented binaries.