ECU reprogramming
01-11-04, 05:52 AM
#151
Junior Member
Join Date: Aug 2001
Location: Tampa, FL
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
jinx
another thought,
If i were designing an ECU, it would consist of two parts.
First would be initialization, followed by a recursive main program. As such, there would be two addresses of concern. The first line of the initialization, which is hard coded in the CPU.
The second would be the first line of the recursive section. There may be yet another section for subroutines or for calls that lead to terminal error routines.
For the nay sayers that complain about the 8-bit processor, the primary limitation is the ability to address only 64k bytes of code directly without some form of memory paging scheme. If you can't write a decent ecu program in 64k bytes, you need to go work for microsoft and write bloat code in C++. Assembly is a real man's language!
Best of luck,
sunrotor
another thought,
If i were designing an ECU, it would consist of two parts.
First would be initialization, followed by a recursive main program. As such, there would be two addresses of concern. The first line of the initialization, which is hard coded in the CPU.
The second would be the first line of the recursive section. There may be yet another section for subroutines or for calls that lead to terminal error routines.
For the nay sayers that complain about the 8-bit processor, the primary limitation is the ability to address only 64k bytes of code directly without some form of memory paging scheme. If you can't write a decent ecu program in 64k bytes, you need to go work for microsoft and write bloat code in C++. Assembly is a real man's language!
Best of luck,
sunrotor
01-11-04, 06:29 AM
#152
Junior Member
Join Date: Aug 2001
Location: Tampa, FL
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
still reading about the HD6303 for clues,
There are two modes of operation with regards to addressing. Based on the presence of a TC40H373P OCTAL TRISTATE LATCH, the cpu operates in multiplexed mode.
The cpu also uses interrupt requests, which are triggered through a 4013 flip-flop from the HD46821P PIO/PIA which generates an interrupt request on IC606-02 PA0 IRQ_EN connecting to RP612-01 & IC608-10(flip-flop)
Between looking at the ecu interconnect list and the cpu specification (and other IC specs), it should be possible to eventually develop the theory of operation, but what a job. I'm gaining more respect for reverse engineering every day i look at this.
keep on trucking
sunrotor
There are two modes of operation with regards to addressing. Based on the presence of a TC40H373P OCTAL TRISTATE LATCH, the cpu operates in multiplexed mode.
The cpu also uses interrupt requests, which are triggered through a 4013 flip-flop from the HD46821P PIO/PIA which generates an interrupt request on IC606-02 PA0 IRQ_EN connecting to RP612-01 & IC608-10(flip-flop)
Between looking at the ecu interconnect list and the cpu specification (and other IC specs), it should be possible to eventually develop the theory of operation, but what a job. I'm gaining more respect for reverse engineering every day i look at this.
keep on trucking
sunrotor
01-11-04, 11:34 AM
#153
Senior Member
Join Date: Dec 2001
Location: Longmont, Co
Posts: 297
Likes: 0
Received 0 Likes
on
0 Posts
Has anyone thought about asking Mazda for the original (commented) assembly code? By this point they can't be liable for any rx7, and I doubt they'd be worried about giving away engineering secrets from an ecu this old.
If someone has a good adress (snail mail) to contact them at, lets put together a petition for them to release the code.
If someone has a good adress (snail mail) to contact them at, lets put together a petition for them to release the code.
01-11-04, 01:35 PM
#154
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Guys, the code entry points of interest are the reset location and the interrupt service routine vectors. (And maybe one or two other things, TBD.)
These are all stored at the very end of the rom.
Here are the entry points from my mazda.sym file.
;Program entry points via reset or interrupt
vector 0xFFFE reset
vector 0xFFFC NMI_(non-maskable_interrupt)
vector 0xFFFA SWI
vector 0xFFF8 IRQ1
vector 0xFFF6 IRQ2_ICI
vector 0xFFF4 IRQ2_OCI
vector 0xFFF2 IRQ2_TOI
vector 0xFFF0 IRQ2_SIO
;this jumps to somewhere outside of the ROM
;vector 0xFFEE TRAP_(undefined_instruction)
;this may or may not be a program entry point
vector 0xFFDE No_idea
These are all stored at the very end of the rom.
Here are the entry points from my mazda.sym file.
;Program entry points via reset or interrupt
vector 0xFFFE reset
vector 0xFFFC NMI_(non-maskable_interrupt)
vector 0xFFFA SWI
vector 0xFFF8 IRQ1
vector 0xFFF6 IRQ2_ICI
vector 0xFFF4 IRQ2_OCI
vector 0xFFF2 IRQ2_TOI
vector 0xFFF0 IRQ2_SIO
;this jumps to somewhere outside of the ROM
;vector 0xFFEE TRAP_(undefined_instruction)
;this may or may not be a program entry point
vector 0xFFDE No_idea
01-11-04, 01:51 PM
#155
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by incendui
Has anyone thought about asking Mazda for the original (commented) assembly code? By this point they can't be liable for any rx7, and I doubt they'd be worried about giving away engineering secrets from an ecu this old.
If someone has a good adress (snail mail) to contact them at, lets put together a petition for them to release the code.
Has anyone thought about asking Mazda for the original (commented) assembly code? By this point they can't be liable for any rx7, and I doubt they'd be worried about giving away engineering secrets from an ecu this old.
If someone has a good adress (snail mail) to contact them at, lets put together a petition for them to release the code.
They do not bear a copyright notice, either on the chip or in the ROM contents. Before 1989, this was required on copyrighted items.
01-11-04, 02:55 PM
#156
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
Hmmm, I don't know if anyone has evr tried that approach.
Loudroom. I've found a few things that I'll be posting here later this Evening.
Loudroom. I've found a few things that I'll be posting here later this Evening.
01-12-04, 02:03 PM
#157
Rotary Enthusiast
Join Date: Aug 2002
Location: MO
Posts: 850
Likes: 0
Received 0 Likes
on
0 Posts
Email from Mazdaspeed
Chad, if you mean the programming in the ECU for the fuel mapping, timing, etc., sorry, but it is absolutely NOT possible. Mazda WILL NOT give this information out, as it is considered propreitary information. Even for our own use, we cannot get this information for racing. We have to use the aftermarket ignitions systems as well. There is no-one you can contact. You'll have to try to reverse engineer it, if it's that important. Please note, that this is not 'permission' to reverse engineer, but merely a possibility available to a person.
Brian K. Burrow
MAZDASPEED MOTORSPORTS DEVELOPMENT
Mazda North American Operations
949-222-2651
800-435-2508
Chad, if you mean the programming in the ECU for the fuel mapping, timing, etc., sorry, but it is absolutely NOT possible. Mazda WILL NOT give this information out, as it is considered propreitary information. Even for our own use, we cannot get this information for racing. We have to use the aftermarket ignitions systems as well. There is no-one you can contact. You'll have to try to reverse engineer it, if it's that important. Please note, that this is not 'permission' to reverse engineer, but merely a possibility available to a person.
Brian K. Burrow
MAZDASPEED MOTORSPORTS DEVELOPMENT
Mazda North American Operations
949-222-2651
800-435-2508
guess that wont work :X
01-12-04, 04:48 PM
#158
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
Yeah I was gonna say, it's probably all proprietary. Just like Honda. I don't even think Mugen had access to the code, but I could be wrong.
We'll get it damn it!!!!!!!
We'll get it damn it!!!!!!!
01-12-04, 10:41 PM
#161
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by jinx22630
Loudroom, were you able to do dumps of the two eproms? IC04 and IC05?
Loudroom, were you able to do dumps of the two eproms? IC04 and IC05?
I need to hunker down and translate some of the code by hand, as a sanity check of the disassembly, but I haven't had time yet.
If one was to download the 2 images from the 16paws site, join them into one large image and then disassemble them using dasmx and the symbol files I've uploaded, they'd be at the same point as me.
01-13-04, 03:42 AM
#162
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
Ok, think I'm back on track. Loudroom try to do the dasm using the symbol file for the other two roms and see what you think. I've checked some things and they seem the same so try it and let me know what you think.
I'm just hoping that this would save tome time, if the are essentially the same.
I'm just hoping that this would save tome time, if the are essentially the same.
01-15-04, 08:52 AM
#164
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
I' ve managed to trace most of the signals from the middle connector through the analog board. Once I finish all of them, I'll need a place to post the schematics.
Also, mazdaspeed7 is being nice enough to give me a ford MAF to do some testing
Also, mazdaspeed7 is being nice enough to give me a ford MAF to do some testing
01-15-04, 11:29 AM
#165
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
That's awesome, have to do something nice for him in return. I'd like to compare notes on the dasm, just so we can synch up on where we are.
01-15-04, 12:34 PM
#166
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by jinx22630
That's awesome, have to do something nice for him in return. I'd like to compare notes on the dasm, just so we can synch up on where we are.
That's awesome, have to do something nice for him in return. I'd like to compare notes on the dasm, just so we can synch up on where we are.
01-15-04, 03:03 PM
#167
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
gotcha, i'm jumping in feet first on the dasm. When you get a chance, look at your dasm and tell me what you think about the fuel map(s) I'm having a little trouble figuring out where they actually begin. In my dasm there are quite a few, it's kinda weird and I'm just trying to get an idea of the structure. Are they 16 X 16 or something else?
01-16-04, 10:03 AM
#168
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
I figured I should probably post a link to this thread here:
http://forums.corvetteforum.com/zero...&id=1546201287
specfically for this post by me:
"Thanks. It's been a decision between the '88 Corvette and the '88 Mustang MAF's.
It looks like I'll be going with the mustang unit, for 3 reasons:
1) They're both physically about the same size, but the Mustang MAF has an aluminum body, meaning it doesn't have the heatsink inside the sensor like the 'vette.
2) The Mustang MAF is cheaper $90 vs. $200 at Pep boys or Adv. Auto Parts.
3) I'm getting one for free.
I liked the fact that the 'vette sensor is made by bosch and has a burn off cycle, but I'm trying to keep things cheap and simple."
Do we have a consensus on this? I think we should both use the same sensor, this would allow us to share the same conversion table.
Also,
I need to find datasheets for some of the parts inside the ECU. There are about 4 ICs that I need info on.
If anybody know of a good datasheet search engine, I'd appreciate a link.
http://forums.corvetteforum.com/zero...&id=1546201287
specfically for this post by me:
"Thanks. It's been a decision between the '88 Corvette and the '88 Mustang MAF's.
It looks like I'll be going with the mustang unit, for 3 reasons:
1) They're both physically about the same size, but the Mustang MAF has an aluminum body, meaning it doesn't have the heatsink inside the sensor like the 'vette.
2) The Mustang MAF is cheaper $90 vs. $200 at Pep boys or Adv. Auto Parts.
3) I'm getting one for free.
I liked the fact that the 'vette sensor is made by bosch and has a burn off cycle, but I'm trying to keep things cheap and simple."
Do we have a consensus on this? I think we should both use the same sensor, this would allow us to share the same conversion table.
Also,
I need to find datasheets for some of the parts inside the ECU. There are about 4 ICs that I need info on.
If anybody know of a good datasheet search engine, I'd appreciate a link.
01-16-04, 11:46 PM
#169
Junior Member
Join Date: Aug 2001
Location: Tampa, FL
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
loudroom,
If you want assistance tracking down old\obsolete parts, just post them, and we'll try and dig something up. I have 25 years of electronics manufacturing, and some contacts, that may help get the data you need.
It isn't uncommon to try this kind of thing when your customer is trying to build spare printed circuit boards years after the original units were made. I've spent more time at this than i care to admit. Shame I can't charge my going rate!!
sunrotor
If you want assistance tracking down old\obsolete parts, just post them, and we'll try and dig something up. I have 25 years of electronics manufacturing, and some contacts, that may help get the data you need.
It isn't uncommon to try this kind of thing when your customer is trying to build spare printed circuit boards years after the original units were made. I've spent more time at this than i care to admit. Shame I can't charge my going rate!!
sunrotor
01-17-04, 01:09 AM
#170
Daily Domestic Killer
Join Date: Mar 2001
Location: San Antonio, Tx, USA
Posts: 2,425
Likes: 0
Received 0 Likes
on
0 Posts
Loudroom... I'd be will to send you my performace chip that I got of ebay, if you pay the cost to send it back to me...after you copy it.....I'm not even sure if it is the real thing..
e-mail me morphious@satx.rr.com
e-mail me morphious@satx.rr.com
01-17-04, 04:40 PM
#171
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by sunrotor
loudroom,
If you want assistance tracking down old\obsolete parts, just post them, and we'll try and dig something up. I have 25 years of electronics manufacturing, and some contacts, that may help get the data you need.
It isn't uncommon to try this kind of thing when your customer is trying to build spare printed circuit boards years after the original units were made. I've spent more time at this than i care to admit. Shame I can't charge my going rate!!
sunrotor
loudroom,
If you want assistance tracking down old\obsolete parts, just post them, and we'll try and dig something up. I have 25 years of electronics manufacturing, and some contacts, that may help get the data you need.
It isn't uncommon to try this kind of thing when your customer is trying to build spare printed circuit boards years after the original units were made. I've spent more time at this than i care to admit. Shame I can't charge my going rate!!
sunrotor
Here are the chips I'm battling with right now. I'd like datasheets on them, or at least a description.
If I can get datasheets one these chips, I'll be able to complete my schematics for the analog board.
IC500:
nonstandard 24 pin DIP package, 0.070" between pins, 0.300" between rows
Two lines of text on the package:
First line:
D 151821-0020
Second line (smaller print than the first, lower right corner):
701AH
The second line is probably just a datecode.
IC450:
standard 8 pin DIP package
Three rows of text on the package
First line:
NEC JAPAN
Second line:
C1251C
Third line:
645C
IC100:
standard 16 pin DIP package
Two rows of text on the package
First line (the ND looks like a manufacturer's logo):
ND SE057
Second line (right justified):
1G07A
IC000:
Weird, ten pin, single row package, 0.10" pin spacing, plastic package is 0.7" high, .29" wide, beveled at the top of the package on the left and top edges.
One line of text
D HC131 1G21
(the 1G21 is in smaller text, probably a datecode)
IC400:
Weird, twelve pin, single row package, 0.10" pin spacing, plastic package is 0.68" high, .20" wide, beveled and notched at the top of the package on the left edges.
One line of text:
D HC128 1G20
(the 1G20 is in smaller text, probably a datecode)
All packages are black plastic. All are thru-hole devices.
01-20-04, 02:00 PM
#172
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by BlackRx7
Loudroom... I'd be will to send you my performace chip that I got of ebay, if you pay the cost to send it back to me...after you copy it.....I'm not even sure if it is the real thing..
e-mail me morphious@satx.rr.com
Loudroom... I'd be will to send you my performace chip that I got of ebay, if you pay the cost to send it back to me...after you copy it.....I'm not even sure if it is the real thing..
e-mail me morphious@satx.rr.com
01-20-04, 02:03 PM
#173
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
Just an update here.
I've started looking at the disassembled code from the ECU. It looks like the fellow on the 16 paws site is right again, and this processor is some variant of an HD6303, not described in the datasheets posted on the site.
I've started trying to get a register map for the lower addresses and it looks like these two addresses are like this, NOT like the datasheet:
0x001B Output compare register 2 (high)
0x001C Output compare register 2 (low)
Has anybody tried to get ahold of this guy?
I've started looking at the disassembled code from the ECU. It looks like the fellow on the 16 paws site is right again, and this processor is some variant of an HD6303, not described in the datasheets posted on the site.
I've started trying to get a register map for the lower addresses and it looks like these two addresses are like this, NOT like the datasheet:
0x001B Output compare register 2 (high)
0x001C Output compare register 2 (low)
Has anybody tried to get ahold of this guy?
01-20-04, 06:48 PM
#174
Senior Member
Join Date: Sep 2003
Location: Syracuse, New York
Posts: 488
Likes: 0
Received 0 Likes
on
0 Posts
It seems there were a crapload of different verison of this CPU.
http://members.tripod.com/kmi9000/kmi_proc.htm
http://www.212cafe.com/download/8051...S32_/E6800.ASM
http://www.cpu-museum.com/630x_e.htm
http://www.geocities.com/TheTropics/...srguide-5.html
http://www.geocities.com/TheTropics/...lator/sim68xx/
http://www.d1.dion.ne.jp/~ytera/1chipCPU.htm
Above are some links about it.
The 16paws site has datasheets for 3 types of this processor but I'm going to be looking for more.
http://members.tripod.com/kmi9000/kmi_proc.htm
http://www.212cafe.com/download/8051...S32_/E6800.ASM
http://www.cpu-museum.com/630x_e.htm
http://www.geocities.com/TheTropics/...srguide-5.html
http://www.geocities.com/TheTropics/...lator/sim68xx/
http://www.d1.dion.ne.jp/~ytera/1chipCPU.htm
Above are some links about it.
The 16paws site has datasheets for 3 types of this processor but I'm going to be looking for more.
01-21-04, 03:46 PM
#175
Senior Member
Thread Starter
Join Date: Mar 2003
Location: Front Royal, Virginia
Posts: 328
Likes: 0
Received 0 Likes
on
0 Posts
I've emailed him numerous times with no reply. He posts on the RXTech Yahoo forum as well, so I've been looking around there to get ideas. I also know that he was somehow in cahoots with the Henrick guy too, which I've also emailed a bunch of times. Seems like either they don't want to be bothered with it anymore, or they have other plans for this project.