3P's TCCS Disassembly/Analysis

Manianac

New Member
Oct 9, 2010
11
0
0
Indy
jetjock;1655727 said:
Oh that's cold but don't worry Nick, it'll happen to you.

Manianac: At least one brand of development system with emulation support for the chip was available back in the 80's. I know because I've used it.

Awesome, I had no idea. Now I'm not too hopeful on ever acquiring this, but it would be pretty helpful.
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Well, I had the modified ECU running in the car this evening. The good news is it runs, and new board fits nicely in the original case. The bad news is there's an intermittent miss and code 53 ("knock control program faulty"). Code 53 is a weird one, like 51 it does not get retained. Likely related to an error in our VHDL code that allows the ECU to run externally. Some work still to be done.... I'll post a video shortly when I get some time.
 

Manianac

New Member
Oct 9, 2010
11
0
0
Indy
Any chance you have more documentation on more of the I/O? For instance the SMRC_SIR bits? I noticed you've labeled the SIN1 - 3, and i'm guessing bit 0 is SIN0.

What of TAIT? I only see bit4 as ASR2 edge trigger and bit5 as ASR3 edge trigger.

SSD? I see bit7 indicates data in the input buffer, bit5 is ready to accept byte to output buffer?

DOUT, LDOUT, and DOM? I see clearing DOM, sets DOUT bits to immediate latch, but what else can be done with them?

I see setting DDRA and DDRB bits set the respective port A/B bits to outputs instead of inputs. Now does PORTAL latch on only inputs or outputs as well? I don't see any use for PBCS as its always cleared, so I'm not sure its operation.

As for bit4 - bit7 of PORTD, I don't see any code using it, so I'm not sure on its operation as well. RAMST I only see read/write control for $80 - $90, not sure on the rest of it.

Finally for the interrupt request control. Say for instance CPR0 matches the TIMER value, is IRQL bit set immediately, or is it only set if the IMASK bit matches? If it is set immediately, I figure it pretty much "queues" the interrupt until the appropriate IMASK bit is set, then it will run. Otherwise I'm guessing it will only set the IRQL bit if the appropriate IMASK bit is set, and call the interrupt as soon as it sees the IRQL bit.

Sorry for all the questions, I've yet to finish the reader board, so I'm unable to test any of these.
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Some photos of the new board installed in the ECU.

p1661066_1.jpg


p1661066_2.jpg


p1661066_3.jpg


p1661066_4.jpg
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
SMRC/SIR bits 0-3 set the baud rate of the serial CLK signal. When read, they give the logic level of the SINx signals. Often used to read configuration data set by resistors on the ECU board. Also some parity functions.

TAIT bits 0-3 control the timer clock rate. Bits 4/5 control whether ASRx triggers on hi-lo or lo-hi transition.

DOUT can be either a regular output port (DOM=0), or set to automatically load DOUT on a timer event (used by the ECU to preprogram injector and ignition events based on a future timer event CPRx). Data to be output to the DOUT pins is first written to the DOUT register. Depending on DOM, the data latches immediately (DOM.x=0) or after Timer (CPRx) event (DOM.x=1)

PortD bits 4-7 read the logic level of ASRx input I think.

Setting IRQL will trigger the interrupt immediately. I would guess priority is established based on the rank of the interrupt with RESET the highest priority. Haven't verified it though. IMASK must be set to trigger respective interrupt. IRQL and must be cleared immediately or interrupt will continue to fire.

PBCS is tricky. It is disabled in external mode, and it's functions must be emulated in your expander CPLD. It is used to read the status of IS. and IRP.
 

supra90turbo

shaeff is FTMFW!
Mar 30, 2005
6,152
32
48
40
MA, 01440
I'm amazed that this thread is still full steam ahead. I love it! I can't understand most of it, but I'm amazed at the work that is still going into it! Keep up the good work and I'll likely be in for the initial production run!
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Yeah, that looks very similar, even has the same FLASH ROM if I am making out the numbers right. I've solved the code 53 error I was getting. Now working on the intermittent miss which seems related to noise.
 
Last edited:

IBoughtASupra

New Member
Mar 10, 2009
4,455
0
0
Queens, NY
So to recap, you have the daughterboard in the ECU running and able to communicate through the USB and now you guys are trying to develop an emulator?
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Yes, we have the ECU running off of external memory and can read data directly from the ECU diagnostic interface. Since the code is loaded into RAM at bootup, it is also possible to modify the code as well during ECU operation. Current plans are to develop the software interface to allow real time data logging and code changes. Since you need to understand the factory code in order to modify, there is quite a bit of effort going into reversing the factory code so we know what to modify.

The emulator is a side project by one member that allows the operation of the MCU to be simulated on a PC.
 

supra90turbo

shaeff is FTMFW!
Mar 30, 2005
6,152
32
48
40
MA, 01440
3p141592654;1676000 said:
Yes, we have the ECU running off of external memory and can read data directly from the ECU diagnostic interface. Since the code is loaded into RAM at bootup, it is also possible to modify the code as well during ECU operation. Current plans are to develop the software interface to allow real time data logging and code changes. Since you need to understand the factory code in order to modify, there is quite a bit of effort going into reversing the factory code so we know what to modify.

The emulator is a side project by one member that allows the operation of the MCU to be simulated on a PC.

That is some seriously cool news!
 

Nick M

Black Rifles Matter
Sep 9, 2005
8,897
39
48
U.S.
www.ebay.com
3p141592654;1676000 said:
Yes, we have the ECU running off of external memory and can read data directly from the ECU diagnostic interface. Since the code is loaded into RAM at bootup, it is also possible to modify the code as well during ECU operation. Current plans are to develop the software interface to allow real time data logging and code changes. Since you need to understand the factory code in order to modify, there is quite a bit of effort going into reversing the factory code so we know what to modify.

The emulator is a side project by one member that allows the operation of the MCU to be simulated on a PC.

So you would be able to tune properly a Lex meter that has the screw all the way in to its stop, instead of backed out to create a false (slower) signal?