Powered by Team Mondor
Page 3 of 78 FirstFirst 12345671353 ... LastLast
Results 21 to 30 of 776

Thread: 3P's TCCS Disassembly/Analysis

  1. #21
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Quote Originally Posted by GrimJack View Post
    Good work, folks. This was on my list of things to do for years, but it keeps getting pushed off by real life (tm) concerns.

    I've got high res pics of the GTE ecu floating around somewhere from the HAC sensor mod for the MAFT Pro setup, if you get to the point that you need them, let me know. I wouldn't be much use on the code end of things without some serious reading, I haven't done any machine code for nearly 20 years! All my EEPROM gear has been in storage nearly that long, too.
    Thank you for offer for the 7MGTE ECU pics, but we will try to understand the 7MGE ECU first (the 7MGTE will certainly be next ).

    20 years is quite a long time for sure but if you have some remarks to make when we will start to interpret the code, this will be helpful too.

  2. #22
    Administrator
    GrimJack's Avatar
    Join Date
    Jan 1970
    Location
    Richmond, BC, Canada
    Posts
    12,556

    Default Re: 3P's TCCS Disassembly/Analysis

    I also have access to essentially unlimited storage and bandwidth, so if you want to store information on the 'net, let me know.

  3. #23
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,644

    Default Re: 3P's TCCS Disassembly/Analysis

    Photos of the 7MGE M/T ECU (p/n 89661-14092) whose code is posted above.
    Sorry for the bad lighting. The ECU has been removed in these photos.




  4. #24
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Quote Originally Posted by 3p141592654 View Post
    Photos of the 7MGE M/T ECU (p/n 89661-14092) whose code is posted above.
    Many thanks for the Pictures, 3P. It's now quite clear that this ECU is quite far from the ST165 ECU I have (Knock sensor CPU package, ICs locations).
    I've missed two 7MGE ECUs on ebay.
    Please somebody on SM having this kind of ECU (7MGE M/T pre 88) and being ready to send it to f$*#_&g france for a descent price (paid through paypal) contact me.

    Assembly file last version attached.
    Attached Files Attached Files

  5. #25
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,644

    Default Re: 3P's TCCS Disassembly/Analysis

    Henri, thanks for the update.

    I added a little more info. There is a map from 0xf0b2 to 0xf0f6 that is in the format of [addr, data] that gets loaded to ram at startup using the subroutine starting at 0xfc96.

    These are presumable the defaults for learned values that you get with an ECU reset.

    I've updated the file with this info. Disassembly is addictive, I really should be doing something else right now!
    Last edited by 3p141592654; July 2nd, 2009 at 06:39 PM.

  6. #26
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    Maybe I've found the ignition maps.

    There's a selection between two maps at 0xeb55. Each of these maps are 136 bytes long.

    According to Jeremy Ross in this post, the MR2 AW11 ECU has two main ignition maps (one for Idle, the other for normal running) with 17 timing points across the rpm range.


    Dividing 136 by 17 makes 8, so each timing point (for one dimension) would have 8 bytes to code the others dimensions (maybe TPS, AFM and rpm) and the timing advance value in 16 bits for each of them. I will try to look further in the code on this subject when I'll have a little more time.
    Attached Files Attached Files

  7. #27
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    ... Looked a little further and this might be only 2D maps (ignition advance/RPM).

    In that case, ASR2L being a edge counter might have something to do with RPM. Checking on bit 1 seems to be looking at low values however...

    Almost two o'clock in the morning... time to go to sleep... will dig the subject later.

  8. #28
    Lurker
    Brutus's Avatar
    Join Date
    Jun 2008
    Location
    Vosgian mountains, France
    Posts
    32

    Default Re: 3P's TCCS Disassembly/Analysis

    I found a lot of maps.

    The small four bytes map located at eb86 looks typically like a logarithmic correction (to linear) sensor (small) table.
    The only logarithmic sensors I know on these cars are Intake temperature sensor and water temperature sensor (if someone owning a 7MGE can confirm).
    Since it looks like it's used for correction at 0xeb6c, just after the suspected ignition map reading, it's more likely to be the intake temp sensor in my opinion.
    Attached Files Attached Files

  9. #29
    Lurker

    Join Date
    Oct 2007
    Location
    belgium
    Posts
    2

    Default Re: 3P's TCCS Disassembly/Analysis

    Is there no rom emulator you can use on your board?
    I doubt the ecu has checksums that need correcting for the ecu to operate, so you can probably just change while driving the car.


    Great work btw.

  10. #30
    90T
    3p141592654's Avatar
    Join Date
    Oct 2005
    Location
    Thousand Oaks, CA
    Posts
    3,644

    Default Re: 3P's TCCS Disassembly/Analysis

    The ROM is in the chip and so the processor runs in internal mode. Forcing the chip to run in external mode means that ports A and B no longer exist, as those pins are now required to be used for address and data lines to the external memory.

    Ports A and B are vital to interface the processor to the sensors/actuators, so external logic is then needed to replace the missing port registers and buffers. The accepted practice is to use a PLD to do this, although Mines did it with discrete chips.

    Given the above, I'm not sure a ROM emulator can offer much help.

    According to a number of sources, there is a checksum performed in the code. I have yet to localize where this occurs.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •