I'm not the fountain of knowledge I wish I was, but I'll try to add a few things.
Quote:
|
Of course, that's after everything's been done and figured out. We're a LOOOONG way from that. One of the biggest problems I see is the fact that the TechTom board has two EPROMs. If that's really needed for some technical reason, then no "standard" EPROM simulator is going to work for you guys.
|
The EPROMs aren't the problem IMHO. It's that
second 84-pin PLCC chip sitting on top of the board. I'll come back to that in a second.
Quote:
EDIT: Ah, reading the datasheet again, I'm reminded that this processor uses a goofy half-cycle, banked addressing scheme where 8 bits of the address are presented on the data pins! Lovely. This gets more fun by the minute.
Speaking of the processor, it's a Motorola 65816-based processor. I don't recall if it has custom op codes or not. Again, I need to see another board in here to figure it all out again. This is basically the same processor I used to use back in the mid 80s on the good ol' Apple ][gs. It's also the same processor used in the SNES!
|
I'm not sure what that data sheet is that you're using, but it's not for anything in our ECUs. Ours use a Mitsubishi/Renesas 7700 family MCU. If that's got some family commonalities with this 65xxx processor, I couldn't say. But I can definitely tell you that what we have is a Mitsu/Renesas 77xx architecture.
On that note, if you can actually find a data sheet for a 7793 or 7798, you are a far better man than I. I've engaged several fee based archival services, the services of an electronics design house, and every internet linked archive that I can get my hands on, as well as Renesas themselves. Basically, when Mitsu combined their semi-conductor business with Hitachi and called it Renesas, they didn't bother to archive any of the old printed documentation. To compound matters, the 7790 series chips were only sold to Japanese manufacturers.
That said, there are some documents from other 77xx series chips, so I have at least a general idea of how the architecture works. Which brings me back to that 2nd PLCC....
When you switch the 779x over to external memory mode, you lose something like 20 of the I/O pins that are now reassigned to access the memory. So you need that 2nd chip (some kind of FPGA) to mimic the "lost" functions of the original MCU.
Did I mention that there's no pinout, and no reliable map of the IO registers on the 779x? I've got pinouts for a 7790 and 7791, but those do not match the 7793 and 7798 that are used in our cars.
Quote:
|
The TechTom boards scramble the data, but it's really not difficult to descramble them. They do change the algorithm from board to board sometimes, but again, it's really not that hard.
|
Thanks to a large amount of help from some friends, I've got the scramble algorithm from my Techtom ECU. That's not an issue. I've successfully altered ROM images, scrambled them, and transferred them to standard SST EEPROMs instead of the old AMD EPROMS that Techtom used. It works fine.
Quote:
|
So, the biggest question on my mind at the moment is why the dual EPROMs. Did they just need 128KB of address space? If so, the data in each EPROM will be different, of course. But if they actually contain the same data, then we're left scratching our heads a bit again. If two EPROMs are really necessary, then finding an inline simulator type device will be more complicated and the project starts bogging down...
|
The entire ROM space is only 32k on the 7793 chips, and 48k on the 7798.
Quote:
|
Somebody find me an ECU to poke around on and I'll report back what I find. I'll also post the descrambled binary and point you at the tables of interest. I'm a little surprised nobody has done this before, though.
|
The table area of the ROM was posted a few years ago. The only thing most people found were the fuel and ignition tables. I've made a lot more progress past that, but it's still not fully deciphered. I've actually got table space from two other 3S ECUs as well. It's mostly identical to the 95 Spyder code that was posted.
I also have the operating portion of the ROM, which I had to figure out for myself. I had to heavily re-write a PERL coded disassembler for the 7700 series code in order to actually read it, just to give you an idea of what it took. The Renesas tools don't track the M-flag status, and IDA Pro chokes on the 779x specific features.
So in short, it's a huge amount of work. If I can even get as far as identifying the rest of the tables in my ECU, I'll be happy. Thanks to at FPGA they added, I doubt we'll ever get the point of actually reproducing these things, much less having a real time tunable version.
Let me know if there's anything else I you'd like to know, and I'll do my best to answer.
