Powered by Team Mondor
Page 2 of 78 FirstFirst 1234561252 ... LastLast
Results 11 to 20 of 776

Thread: 3P's TCCS Disassembly/Analysis

  1. #11
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,642

    Default Re: 3P's TCCS Disassembly/Analysis

    JJ: Intel Microcomputer Development System?

    Brutus: Check your PM.

    We are some ways out from a tunable factory ECU, but there is precedent over in the MR2 world. The stock ECU is pretty impressive for something that was developed about the same time as the IBM AT personal computer. More to come, stay tuned.

  2. #12
    creepy-ass cracka
    jetjock's Avatar
    Join Date
    Jul 2005
    Location
    Redacted per Title 18 USC Section 798
    Posts
    9,439

    Default Re: 3P's TCCS Disassembly/Analysis

    3P: Yes but the only Intel MDS I worked with back in those hey-days of MPU development was the Series II that ran ISIS. It's emulation capabilities didn't support this device. There were others that did however. A logic anaylzer was also used.

  3. #13
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Hello everybody,

    I'm working on the code at the moment (Identifying interrupt vectors, locate the main part of the program...).

    Of course, as 3P said this is going to be far easier to decrypt the code after having located the sensors and actuators pins.

    I will bring back a 7MGTE ECU with me this week-end, but I will also bring back a Celica ST165 ECU, since I believe its closer to the 7MGE ECU (single board, 64 pins CPU, only one ignition transistor) we will work with at first.

    Unfortunately, I can't destroy it tearing appart all the components as I only have one of these.

    If anybody has a unused 7MGE ECU for sale, I would be interested to get it.

    It would also be of great help if anyone can post very high resolution pictures (both sides) of a 7MGE ECU for comparison.

    I will post the disassembled file in the beginning of next week, as I will hopefully find interesting stuffs in the code by then.

  4. #14
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    st165-3sgte-ECU.jpg

    OK, found this picture of a ST165 ECU. Please let me know if it's close to the 7MGE ECU or not, because I will work on it until I get a 7MGE ECU.
    I believe the 7MGE must have only 4 transistors (at the bottom of picture, attached to the frame of the ECU) instead of five because injectors opening are grouped by two injectors, instead of being independant from one another on the ST165.

    Here's what I know about the chips at the moment:

    D151801-6430: CPU, what's interesting us.
    TC40508P: Injector driver, should be linked with the CPU by four lines.
    D151801-6470: Knock sensor CPU
    D949577-2100: Analog Digital Converter, communicates using a PWM protocol with the Main CPU through pin 3 of this IC. I think it's linked to some ASR pin of the CPU.
    HC150: Voltage converter (12V/5V, digital sensors go through this)
    MF168 ?
    SE022: Not sure about that one, but seems to be some kind of timer.

    Please let me know about the 7MGE ECU

  5. #15
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,642

    Default Re: 3P's TCCS Disassembly/Analysis

    Henri, it's very close, but from memory looks a little different. I'll post up a picture of the 7MGE board that I pulled the CPU out of for the assembly code posted above.

    Your ECU reader stuff is boxed up, need to get it mailed out today.

  6. #16
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Quote Originally Posted by 3p141592654 View Post
    Henri, it's very close, but from memory looks a little different. I'll post up a picture of the 7MGE board that I pulled the CPU out of for the assembly code posted above.

    Your ECU reader stuff is boxed up, need to get it mailed out today.
    Thank you for your time Jon,

    I'm trying to find the same ECU as yours on ebay. In fact, the most difficult is to find somebody accepting to send something to Europe (These ECUs are hardly ever found here). I will let you know as soon as I can put a hand on one.

    Here's the little I have found now (more to come this week).
    The main ADC output (pin 3) goes to ASR0 (This can be checked with a multimeter. Resistance should be close to 0 Ohms).
    Injector driver is linked to C3.
    PB3 and PB2 goes to the knock detection IC.

    I'm struggling with the instruction set now, I have googled everywhere to find some litterature about unusual instructions like TBBS, TBBC, BGEA, BLTA... etc to check their effect on the processor, but couldn't find anything except this decrypted version of Kashi's Datasheet:
    http://members.shaw.ca/tibiivan/mk2/...0Decrypted.pdf

    As you can see, the instruction set is described, but with some japanese inside. Does anybody read japanese or knows someone who could translate this?

  7. #17
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,642

    Default Re: 3P's TCCS Disassembly/Analysis

    TBBS and TBBC are a bit confusing to me too. Here is what I know.

    TBBS: Branch if bit set ( bit.(op.1) of M[op.2]) = 1 then PC=PC+op.3

    opcode: 0x35
    operand 1: first 3 bits specify bit to test (0 through 7), remaining 5 bits specify memory location (limited to first 32 bytes of RAM)
    operand 2: 8 bit relative shift like the other branch functions

    TBBC: Branch if bit clear ( bit.(op.1) of M[op.2]) = 0 then PC=PC+op.3

    BGEA: Branch if arithmetic >= (N ∀ V = 0)
    Branches if the result of an arithmetic compare was greater than or equal to
    operand 1: 8 bit relative shift (all branch instructions use 8 bit relative for the branch so can only access +/- 127 bytes from the instruction location)

    Here N (negative) and V (overflow) are two bits in the ECU CCR register

    BLTA: Branch if arithmetic < (N ∀ V = 1)
    Branches if the result of an arithmetic compare was less than

    and so on for the other branches. These closely follow the instructions you can find in the MOT 65xx and MOS6502 processors.

    I have decoded the Kashi document. Will need to figure out where to post it.

  8. #18
    Administrator
    GrimJack's Avatar
    Join Date
    Jan 1970
    Location
    Richmond, BC, Canada
    Posts
    12,556

    Default Re: 3P's TCCS Disassembly/Analysis

    Good work, folks. This was on my list of things to do for years, but it keeps getting pushed off by real life (tm) concerns.

    I've got high res pics of the GTE ecu floating around somewhere from the HAC sensor mod for the MAFT Pro setup, if you get to the point that you need them, let me know. I wouldn't be much use on the code end of things without some serious reading, I haven't done any machine code for nearly 20 years! All my EEPROM gear has been in storage nearly that long, too.

  9. #19
    United States of America
    isnms's Avatar
    Join Date
    Mar 2005
    Location
    Oklahoma
    Posts
    2,226

    Default Re: 3P's TCCS Disassembly/Analysis

    Quote Originally Posted by 3p141592654 View Post
    I have decoded the Kashi document. Will need to figure out where to post it.
    You get 2gb of free space at snapdrive.net. All kinds of file types. I posted my pdf's there.

  10. #20
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Quote Originally Posted by 3p141592654 View Post
    TBBS and TBBC are a bit confusing to me too. Here is what I know.

    TBBS: Branch if bit set ( bit.(op.1) of M[op.2]) = 1 then PC=PC+op.3

    opcode: 0x35
    operand 1: first 3 bits specify bit to test (0 through 7), remaining 5 bits specify memory location (limited to first 32 bytes of RAM)
    operand 2: 8 bit relative shift like the other branch functions

    TBBC: Branch if bit clear ( bit.(op.1) of M[op.2]) = 0 then PC=PC+op.3

    BGEA: Branch if arithmetic >= (N ∀ V = 0)
    Branches if the result of an arithmetic compare was greater than or equal to
    operand 1: 8 bit relative shift (all branch instructions use 8 bit relative for the branch so can only access +/- 127 bytes from the instruction location)

    Here N (negative) and V (overflow) are two bits in the ECU CCR register

    BLTA: Branch if arithmetic < (N ∀ V = 1)
    Branches if the result of an arithmetic compare was less than

    and so on for the other branches. These closely follow the instructions you can find in the MOT 65xx and MOS6502 processors.

    I have decoded the Kashi document. Will need to figure out where to post it.
    Thanks for the help again.
    I need to re-read some Motorola litterature.

    I've started working on putting absolute adresses on the relative branch instructions since yesterday to make the code clearer.
    When branch offset is less than 128 this is a forward branch, and when it's equal or greater, this is a 256-Offset reverse branch, if I remember well.
    This is a pretty long job to do (I don't feel like modifying the disassembler now), so this will require two or three days (not a lot of spare time).

    I should be able to get a 7MGE ECU next week, hopefully.
    I will then be able to send voltage to the digital sensors inputs on the ECU plug to see which pin of the processor is concerned.
    The same way, I will be able to apply 5 volts or ground to the pins of the processor (I/O pins, of course) to check which actuator is concerned on the ECU plug pin.
    This won't work for the injectors, but this will be faster than route tracing at the beginning.
    Last edited by Brutus; June 30th, 2008 at 03:01 PM.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •