EA82 ECU experimenting

[DaveT]

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.
Object code compatible with 6801 family.

 

 

[MR_Loyale]

I wonder if a Motorola 6800 decompiler would work.

Edited December 31, 2016 by MR_Loyale

[DaveT]

HD6301V1P processor Data Sheet.pdf

 

Here is the data sheet.

 

It mentions compatibility with the HMCS6800 family.

 

[DaveT]

Subaru GL Loyale ROM.txt

 

This is a text file [hex] of the ROM

 

I can send a .bin file of it, but apparently, not through the message board.

 

 

[skishop69]

Ok, so in regards to my post in the other thread.... Great! You were able to read the ROM! We still need someone who knows or can deconstruct the coding for the processor so we know which parts of that hexadecimal log can be safely altered. Without that coding, we have no way of knowing how to alter the log.

 

PM me so you can send me the BIN and I'll try plugging it into a tuning program to see what happens. Maybe we'll get lucky, but I'm not holding my breath.

Edited December 31, 2016 by skishop69

[MR_Loyale]

Been a while since I worked with 6800 opcodes and operands. I have worked with 68HC11 protoboards so if this bears any resemblance it may be possible. I will give it a look.

 

If this is a Motorola 6800 based instruction set the data is in big endian format. Still looking at the manual.

Edited December 31, 2016 by MR_Loyale

[MR_Loyale]

Here is the link to the 6301 series handbook with hardware, software techniques:

 

http://www.jaapsch.net/psion/pdffiles/hd6301-3_handbook.pdf

[MR_Loyale]

So looking at this, I am thinking that the CPU instruction set is based upon the Motorola 6800. If this is true, there should be assembler/editor programs. Hitachi may have licensed this and produced their own chips.

 

Here is my reasoning for thinking this, please sanity check this out:

 

From the HD6301V1P datasheet, go to scanned page 63 (23 in your pdf reader) and look at table 8 where the opcodes are listed.

 

Then open this link for the Motorola instruction set

 

http://www.lucidtechnologies.info/6803_instr.pdf

 

I do a quick comparison of the accumulator A  ADD instruction (ADDA) and it appears to me that they have the same hex designation in all the five addressing modes.  Can someone else independently confirm?

 

Update: Came across this wikispace on the 6800 and it also lists a Hitachi 6301 controller version.  I think Hitachi licensed the 6800 architecture and adapted it for industrial and hardened environments. They also added 6 extra instructions including a sleep (slp).

 

https://chessprogramming.wikispaces.com/6800

Edited December 31, 2016 by MR_Loyale

[MR_Loyale]

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.

Object code compatible with 6801 family.

 

 

Can you give me some more info on the txt output format of your reader? How many bytes to the right of the colon are the address indicators? Or is it assumed from address 0000? This is a critical detail.

Edited December 31, 2016 by MR_Loyale

[MR_Loyale]

Here is a nice little intro to 6800 assembly langauge programming:

 

http://www.hvrsoftware.com/6800.pdf

[MR_Loyale]

More evidence this may indeed be the same Motorola 6800 instruction set:

 

"After the 6800 project Bennett worked on automotive applications and
Motorola became a major supplier of microprocessors used in automobiles." 

 

https://en.wikipedia.org/wiki/Motorola_6800

[MR_Loyale]

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.

Object code compatible with 6801 family.

 

 

What is the packaging of the HD6301V1P? Dual inline or square?  Are there any other RAM or ROM chips? We may need to do some tracing on the address bus to the ROM chip to see where in the address space the ROM lives. I suspect it is in the lower 8K as the 6800 starts program execution at address 0000.

 

EDIT: Actually our processor gets it's starting address from the RES vector at the end of the memory map ($FFFE and $FFFF).

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

We should be able to identify subroutines by searching for JSR (jump subroutine $90) opcodes and their endpoints with the RST ($38)opcodes. This would help in delineating code regions from data regions.

 

EDIT: The disassembler claims it can do this for us.

Edited January 1, 2017 by MR_Loyale

[DaveT]

The processor is 40 pin dip. I'll try looking up the other 2 good sized chips near the processor and EPROM. I'll have some time later today.

[DaveT]

Other ICs - Hitachi HD46520P  40pin DIP, right alongside of the processor. 

 

NEC D449C-1  24pin DIP along side of the EPROM.

 

So far, I haven't been able to find any information on these 2.

 

The 6301 history ideas above make sense to me.
 

In the text HEX file, The leading :20 is ignored.  using the first line as reference, the address is the next group of numbers, the 00 [first data byte] is 7F.  Looks like 32 bytes per line.

[MR_Loyale]

Looking at some documents from Hitachi regarding the processor, it apparently could be ordered with onboad eprom masked in at time of manufacture.  So some of the actual coding may be onboard the processor chip itself, It would make sense though that any sort of car model specific stuff would be on an external UV erasable chip in case a bug was found, new regulations happened , recall etc. 

 

Are there possibly any ports that may be a diagnostic port (possibly an RS232 used for QC)?

Edited December 31, 2016 by MR_Loyale

[skishop69]

So looking at this, I am thinking that the CPU instruction set is based upon the Motorola 6800. If this is true, there should be assembler/editor programs. Hitachi may have licensed this and produced their own chips.

 

Here is my reasoning for thinking this, please sanity check this out:

 

From the HD6301V1P datasheet, go to scanned page 63 (23 in your pdf reader) and look at table 8 where the opcodes are listed.

 

Then open this link for the Motorola instruction set

 

http://www.lucidtechnologies.info/6803_instr.pdf

 

I do a quick comparison of the accumulator A  ADD instruction (ADDA) and it appears to me that they have the same hex designation in all the five addressing modes.  Can someone else independently confirm?

 

Update: Came across this wikispace on the 6800 and it also lists a Hitachi 6301 controller version.  I think Hitachi licensed the 6800 architecture and adapted it for industrial and hardened environments. They also added 6 extra instructions including a sleep (slp).

 

https://chessprogramming.wikispaces.com/6800

Oh my brain hurts. I'm way past rusty. For what it's worth, it does appear the hex designation is the same. That's about as much help as I'm going to be for that portion. lol As for the address space, 000F seems to stick in my brain, but that would be in regards to whatever PROM GM was using back then and I can't check that until Tuesday which is when I'm going to try and plug the BIN into a tuning program just for gits and shiggles.

[MR_Loyale]

Other ICs - Hitachi HD46520P  40pin DIP, right alongside of the processor. 

 

NEC D449C-1  24pin DIP along side of the EPROM.

 

So far, I haven't been able to find any information on these 2.

 

The 6301 history ideas above make sense to me.

 

In the text HEX file, The leading :20 is ignored.  using the first line as reference, the address is the next group of numbers, the 00 [first data byte] is 7F.  Looks like 32 bytes per line.

 

 

I think the Hitachi HD46520P  40pin DIP is an A/D converter based upon searches for this I was directed to the spec sheets for the HD46508 which may be a substitute or one in the same family of "Analog Acquisition Units" as they call them:

 

http://kazus.ru/datasheets/pdf-data/3211033/HITACHI/HD46508A-2.html

 

Possibly this is used to digitize sensor inputs such as the TPS and CTS. Some following of the board traces to where they emerge to a connector may give a clue as we can identify the wires coming from both and their connector to the ECU box.

Edited December 31, 2016 by MR_Loyale

[ANIM_Hooneru]

Hey fellas,

What an interesting topic! Its way above my understanding level, but i'm going to be following anyway.

 

MR_Loyale, in regards to a RS232 port, I stumbled upon an interesting site the other day when I was doing some Subaru Select Monitor research for my EJ22 swap. The site is here. http://www.alcyone.org.uk/ssm/protocol.html

Also check out the headings "How to build a PC adaptor" and "Eavesdroping"

 

That site covers how to make an RS232 connector to use a PC as a SSM, I would imagine with a bit of creativity and a donor harness you could rig it up to get into an ECU outside of a car, or alternatively find the SSM Plug on the vehicle and use that.

I have a 1986 Leone Turbo Auto (Australian edition of course) that I can whip the ECU out of to check out as well. Would be nice to get an archive of numbers and all that.

Edited December 31, 2016 by ANIM_Hooneru

[MR_Loyale]

Found a nice hex editor here:

 

http://www.handshake.de/user/chmaas/delphi/download/xvi32.zip

 

 

I have opened the bin file and I can see areas that are most likely data storage areas for settings of some sort as they have repeating values that would not be opcodes and operands simply due to their repetition.  If we all use the same hex editor with rows arranged in a similar way we can discuss values at addresses using the same point of reference.

 

Here is what it looks like:

 

 

It shows an address for the first byte of the row in the first column. Next are 16 columns showing hex values for each byte. Finally an ASCII representation is shown in the right 16 columns. If there are any human readable strings, they will show up in the ASCII area (maybe Subaru or Leone or something).

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

Here is another useful tool, a 6800 family disassembler. The disassembler takes as input a binary code/data image
file (typically a ROM image) and generates either an assembler source file or a listing file.

 

Here is a link:

 

http://myweb.tiscali.co.uk/pclare/DASMx/

 

Reading through the instructions, it does claim to do Hitachi 6301. This is a command line tool folks, no fancy GUI for you!  I will see if I can get a listing out of this, It also claims to be able to do code threading (eg identify regions of code rather than data).

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

Here is a fun fact, our old Subarus use almost the same microprocessor as the TRS80 Color Computer. Who ever used one of those? Raise your hands.

[MR_Loyale]

Also I want to investigate where in the address space the memory mapped I/O lives. Those will be key to finding the code that reads the TPS and CTS and such.

[MR_Loyale]

Hey fellas,

What an interesting topic! Its way above my understanding level, but i'm going to be following anyway.

 

MR_Loyale, in regards to a RS232 port, I stumbled upon an interesting site the other day when I was doing some Subaru Select Monitor research for my EJ22 swap. The site is here. http://www.alcyone.org.uk/ssm/protocol.html

Also check out the headings "How to build a PC adaptor" and "Eavesdroping"

 

That site covers how to make an RS232 connector to use a PC as a SSM, I would imagine with a bit of creativity and a donor harness you could rig it up to get into an ECU outside of a car, or alternatively find the SSM Plug on the vehicle and use that.

 

I have a 1986 Leone Turbo Auto (Australian edition of course) that I can whip the ECU out of to check out as well. Would be nice to get an archive of numbers and all that.

 

 

If I ever do EJ stuff, that is the site I will start at. Those ECU's are in a different league compared to these old school ECU's  What was the precursor to Subaru SSM?

[Crazyeights]

I have the equipment to erase and re-program (burn) most older UV EPROMS like the 2764 ect. I'll volunteer to try and help if someone gets as far as needing a set of EPROMS burned.