Recent content by Brutus

Looks like you've put the wrong file as attachment. This one will interest me, cause I have lots of 3SGE ECUs with that kind of processor as main CPU. Can you post it again, please? Regarding the 7MGTE ECUs, if someone is ready to provide one, I won't be able to send it back, because I...

Hello everyone, I need 7MGTE ECUs (both grey plug and yellow plugs) to see if the EGR and manual/auto resistors are applicable on these as well and work on the reverse engineering with Jon (3P) when the work on the 7MGE will be mature enough. If anybody have spares, I will pay the shipping...

You're right, that's really strange they didn't use tbbc. This could make sense, since external mode is certainly used for testing. Good idea, I'll modify this when I'll have a moment. Yes indeed... What checksum are you talking about? Since the CPU is ROM only, maybe they don't...

I think you went too fast in reading my previous post, Jon. Take care that the "cmp x, #0x7773" command and the the "setb bit3, $_ASR0NL" command are coded in the same memory space. In the first case, the Program Counter reaches address 0xf6ec and executes the "cmp x, #0x7773" command...

Smart test, Jon! :icon_bigg So it looks like that the disassembler did it's work well. In that case this code is really tricky: f6dc 371f12 tbbc b.0, $_OMODE, 0xf6f1 f6df 33ffd1 ld #0xff, $0xd1 f6e2 797aa9 cmp #0x7a, $0xa9 f6e5 4406 bcc 0xf6ed f6e7 76a9 inc $0xa9 f6e9...

As you can check with the new version, I've put many comments ";code" before each executable part. I removed the fake code generated on the map bytes, and for each ";code" section, I've checked the first address is called somewhere. So hopefully nothing should be out of sync in the disassembled...

Did some bench test and route tracing this weekend to identify the wiring of the sensors and actuators to the processor. The help provided by you guys on ECU wiring last week was very helpful, thanks again. Here's what I've found so far: ASR2 is NE ASR3 is SPD PB6 is TE1 PA4 is IG1 PA5...

Octane change isn't the only possibility there, couldn't this second map be a "some sensor failure" map or whatever? Any clue what these map could be (0xdb26 and 0xdb8f) if they aren't fuel maps? :1zhelp:

Forgot to answer about this the other day. Like Gunnar already said these values are only reprentative of the order where the data can be found in memory. By no means these values are found anywhere inside memory.

We still need to confirm what they are and the scales on the 3D map. This could be of great help if you could send data about fueling and ignition of standalone ECUs for 7MGE so I can build and 3D representation of these for comparison. :1zhelp: What do you mean by "breakpoints" table...

Great! :icon_bigg Didn't remember that part of the TSRM! :ban: Thanks for your support!

Thanks a lot for the clues guys! :icon_bigg Will let you know when I'll find something new!

Yes, the ECU hold the values till redline (leaves a 800 rpm gap to the redline) or the rpm scale is 450rpm instead of 400? I found these four maps in the ECU ROM, so they do exist inside. You mean the maps on the second post (0xeb8a and 0xec13)? Correct me if I'm wrong, but if it's...

The TSRM sensor test procedure involves resistance tests, with the plugs disconnected from the ECU. They don't tell anything about voltages, as far as I know. The AFM is a digital sensor involving pulse frequency on the 7MGTE with Karmann Vortex AFM. I thought the 7MGE used a flapper door...

While we're at it Gunnar, does the attached maps look like ignition maps?