3P's TCCS Disassembly/Analysis

rotor3

New Member
Jul 26, 2009
10
0
0
CA
Looks like my ECU is in MODE2.. Does anyone know how these work in mode2?
My binary is FFh until 0x6000. Confusing at this point
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Mode 2 is used when running with external ROM. From the factory they run mode 7 to use internal ROM.

You're interrupt table looks a little weird to me. Using your nomenclature, I would not expect IRQs 01-06 to point to the same address. What is this code from?
 

rotor3

New Member
Jul 26, 2009
10
0
0
CA
3p141592654;1447833 said:
Mode 2 is used when running with external ROM. From the factory they run mode 7 to use internal ROM.

You're interrupt table looks a little weird to me. Using your nomenclature, I would not expect IRQs 01-06 to point to the same address. What is this code from?

It's from an older Mazda with the same processor. This specific ECU houses two HC11 G5's and this D8x with an external 256k eprom.

I'll need to finish mapping the pins but I can say for sure that this is being used in a mode which hasn't been covered to large degree. The memory addresses / locations are way off (when comparing to the current documentation).

I'll finish mapping the pins from the D8x and share my findings.

Code:
     D8X	HC11G5
01: ASR		PG7
02: ASR0	XIRQ
03: ~NMI	
04: IRP		GND
05: IRL		MODA/LIR
06: Xin		MODA/LIR
07: Xout	
08: CCLK	
09: ADR	
10: IS/~RD	
11: OS/~WR	
12: I/~E	
13: CLK		VSSL
14: Sin3	PB1/A9
15: Sin2	PB2/A10
16: Sin1	PB3/A11
17: Sin0	PB4/A12
18: Sout1	PB5/A13
19: Sout0	PB6/A14
20: PB7/A7	PB7/A15
21: PB6/A6	PC7/D7
22: PB5/A5	PC6/D6
23: PB4/A4	PC5/D5
24: PB3/A3	PC4/D4
25: PB2/A2	PC3/D3
26: PB1/A1	PC2/D2
27: PB0/A0	PC1/D1
28: PA7/A15	PC0/D0
29: PA6/A14	R/W
30: PA5/A13	E
31: PA4/A12	Vrh
32: GND
 
Last edited:

rotor3

New Member
Jul 26, 2009
10
0
0
CA
In case anyone wanted a visual of the setup:
I've removed the D8x and external memory from the board to dump the data.
 

Attachments

  • 2mzzg3m.jpg
    2mzzg3m.jpg
    293.4 KB · Views: 60
  • 1zclocw.jpg
    1zclocw.jpg
    281.9 KB · Views: 59

rotor3

New Member
Jul 26, 2009
10
0
0
CA
one company shot me down. the remaining haven't responded or have promised to track down the datasheet(s).
 

rotor3

New Member
Jul 26, 2009
10
0
0
CA
I've made some changes to the disassembler but need to verify them again. Should make it easier to read the disassembled output.
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
A short update. Despite the lack of posting activity, we have been working hard on the next step of this project.

Attached is an image of the next gen board. This will support USB diagnostics, up to four ROM images stored in flash memory that can be switched in as desired, and also real time map tuning with the code stored in RAM.

The board is about to go to the board shop, then in a few weeks we get is back and can try it out. Hopefully not too full of bugs. Also need to start work on the software to interface to the board. Lots to do, but things are moving ahead.

I've also started work on understanding the 7M-GTE ECU code. We have alot of the I/O traced out, but need to dig into the code.

flashboard.jpg
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Thanks for the support, but the only thing I'm short of is time these days.

The new boards are due to arrive this Wednesday, so we will get to work on building up some prototypes and see how it works!
 

mkiii222

Member
Mar 31, 2005
697
0
16
Troy, MI
Before I say 'put me down for a board' are you selling the boards at this point?

Also, is there any help needed on the GUI side of things?
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Nope, nothing for sale right now. We are debugging the hardware and getting the basic software in place. The GUI is being written for now by Jon Sole using Qt. It will most likely be open source with a GPL license, in which case the community can participate.

By the way, we have looked at the M/T and A/T versions of the GTE ecu and they use different code. That means no simple switch using resistors like the GE ecu. At this time I have not figured out what the resistors control with these ecus.
 

figgie

Supramania Contributor
Mar 30, 2005
5,225
16
38
50
Twin Cities, Minnesot-ah
Ok folks,

just did a massive cleaned up of this thread......

I know everyone is excited about this as it is a very big endevour, but please keep the me 2's or the I buy post out of it. When 3p and crew are ready, they will make a For Sale post or a post accordingly. :)

Also please keep the good job, kudos out of it for now also (everyone knows they are doing a damn good job ;) ). Let the disassemblers/coders do thier magic. The group is busy and they work on their own time lines.... do not get offended if your post was deleted, if I didn't see code or part information. It probably got the axe.

Thanks for understanding.

-Figgie
 
Last edited:

auto351

New Member
Oct 22, 2008
19
0
1
Sydney
Hi,
Just pulled out my 1GGTE chip and was able to read the code, the code starts out the same as the 7M I will post up the files when I have cleaned it up.

You said the 7MGTE A/T & M/T CPU code is different is the numbering printed on the chip the same?
With the 1G A/T & M/T ECU the CPU Chip has the same numbers printed on them which leads me to think they are the same code (I will confirm this soon.) The 1G A/T has extra chips to control the automatic transmission, this maybe getting done inside the CPU on the 7M unit hence the different code for this reason but the main engine tuning is the same?

I hoping this board above will replace the CPU only so with some mods I can fit this to the 1G ECU
Also will you need a special lid to conceal the new daughterboard?

This is an example of the lid to fit daughterboard
1gecudb.jpg


this is how the PCB is mounted
profecu2a.jpg
 
Last edited: