EA82 ECU experimenting

[DaveT]

Wow!
I'll download and check out those programs tomorrow.

I don't see any connections on the ECU other than the external harness connectors, no secret ports.

I can also read & burn & erase these EPROMS.  When it gets far enough, I'll buy some.

 

I'll install a socket in this ECU for the EPROM.

 

I'll post pictures of the PCB tomorrow.  [technically later today]

 

I can trace out where at least some of the external sensor pins are wired, I have generated schematics from a number of circuit boards.

 

The Big IC next to the CPU - I would not be surprised if it was a A to D / D to A converter or Analog I/O of some sort.  There needs to be one, and there are a lot of analog circuity near it.

The PCB looks like its only 2 layer.

 

I still have the first computer I ever put together, an Apple II+  Actually ran it a couple years ago.
I also have a Pentium that runs DOS and Win3.1

 

I've designed a few embedded controller systems, written a little code, but I'm not good enough at assembler to decipher this on my own.

[DaveT]

Why do this?  Well, who knows what we may find?  We can adjust and modify pretty much every other part, why not this one?

 

Part of me always reads "no user serviceable parts inside" as a challenge, not a warning...

[ANIM_Hooneru]

MR_Loyale,

 

I don't know what they refer to the standard before SSM as, however I have an old 1992 OTC Scantool here I use occasionally at the workshop and I have been having a look at how it is set up in the Operations manual.

 

According to the handbook, Pre-88 Leone and XT/Vortex use a single communications line that must transmit and receive on the same line I guess (?) which is terminal #7 at the 17 pin diagnostics plug near the Brake Booster.

However after 88 it refers to using the same 9-Pin SSM Style connector plug for "88-90 Leone, 88-90 XT/Vortex, 89-91 Liberty", so maybe, just maybe, using that same RS232 setup you might be able to go into a late-ish model ECU. (Well, late Leone anyway)

I can get you pictures if you wanna take a looksie anyway.

[MR_Loyale]

MR_Loyale,

 

I don't know what they refer to the standard before SSM as, however I have an old 1992 OTC Scantool here I use occasionally at the workshop and I have been having a look at how it is set up in the Operations manual.

 

According to the handbook, Pre-88 Leone and XT/Vortex use a single communications line that must transmit and receive on the same line I guess (?) which is terminal #7 at the 17 pin diagnostics plug near the Brake Booster.

However after 88 it refers to using the same 9-Pin SSM Style connector plug for "88-90 Leone, 88-90 XT/Vortex, 89-91 Liberty", so maybe, just maybe, using that same RS232 setup you might be able to go into a late-ish model ECU. (Well, late Leone anyway)

 

I can get you pictures if you wanna take a looksie anyway.

 

 

Pics would be nice. This is intriguing because the section 2.6 (PDF pg 169) of the handbook does mention  a built-in serial communications interface.

 

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

So looking at the hd6301 handbook beginning on pdf page 156 looks like there are eight possible configurations of the mcu that are set based upon the state (high or low) of pins 22,21,20 .  The memory map is different depending on how these are configured.

 

Dave - can you visually look at those pins and see if they have a jumper high or low on each? Please report back to us. If you cannot be sure, you might be able to safely bench test this by supplying power and using a digital probe if you have one. These are going to be jumpers or hard wired.

 

Just looking at it though, I think we can eliminate mode7 because we know there is an external ROM and that mode makes everything internal only.

 

0,1,2/4 or 6 appear to be the only modes possible based upon the memory maps show for each mode. I say this because none of the other modes makes available an 8K or greater space, since our EPROM is 8K I think we can eliminate those mode. Tracing should confirm this.

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

Well, looking at pdf pg 179 note (2) at top, after reset, program execution begins at the address values stored in $FFFE and $FFFF (addresses are 16 bit).  These are the last two addresses in the 64K memory space.

 

This is listed as RES (RESET  eg what happens when it is powered off the on) in the vector table below:

 

 

Now depending on our mode (as explained previously) the vector map may or may not live on our EPROM,  It may be masked into the chip from the foundry.

 

Let's assume the vector map is on our EPROM and validate it with a logic exercise. If it is on our EPROM, the then it has to be wired as the last 8K in the 64K memory space. Looking at the possible memory map modes that are configured by the states of P22,P21 and P20 the possibilities are (PDF pg 156):

 

Mode 1 - non-multiplexed

Mode2,4 - multiplexed/RAM

 

 

 

So from our ROM file we see FFFE has value DC and FFFF has 6F. Thus when reset, program execution starts at address  DC6F, IF our EPROM holds the vector table. 

 

That is the rub. If our assumption was true, the address at which program execution should begin would be DC6F. However if we are in one of the modes we assumed, then whatever address the execution begins should occur in our EPROM memory range which is E000 - FFFF. Since DC6F falls below our beginning address, I think our mode is not 1,2 or 4.

 

Confirmation should come when DaveT traces and or measure the states of P22, P21,P20.

 

 

If I am correct, then the modes left are ones which include factory masked ROMS and allow for 8K for our EPROM.  This would leave mode 0 or Mode 6.

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

MR_Loyale,

 

I don't know what they refer to the standard before SSM as, however I have an old 1992 OTC Scantool here I use occasionally at the workshop and I have been having a look at how it is set up in the Operations manual.

 

According to the handbook, Pre-88 Leone and XT/Vortex use a single communications line that must transmit and receive on the same line I guess (?) which is terminal #7 at the 17 pin diagnostics plug near the Brake Booster.

However after 88 it refers to using the same 9-Pin SSM Style connector plug for "88-90 Leone, 88-90 XT/Vortex, 89-91 Liberty", so maybe, just maybe, using that same RS232 setup you might be able to go into a late-ish model ECU. (Well, late Leone anyway)

 

I can get you pictures if you wanna take a looksie anyway.

 

 

Any chance you can scan that manual and upload the PDF?

[DaveT]

I'll check those mode pins and look for the serial port first.

[DaveT]

ECU circuit board removed from case.  EPROM removed from the board.

[DaveT]

P20 = pin 8

P21 = pin 9

P22 = pin 10

 

All 3 are tied high by 1.00K resistors.

 

Pin 7 [standby NOT] is wired directly to +5V

[MR_Loyale]

P20 = pin 8

P21 = pin 9

P22 = pin 10

 

All 3 are tied high by 1.00K resistors.

 

Pin 7 [standby NOT] is wired directly to +5V

 

That would mean mode 7 (single chip mode). That doesn't make sense looking at the memory map for mode 7. That indicates NO external memory. We know we have an EPROM. What am I missing here?

[skishop69]

In regards to the post you made in the other thread, I believe the intent here is to gain access to allow tuning. If that is the case, the things we should be able to change are as follows (and this is from memory as I haven't tuned anything OBD1 in years) :

 

AFR table: This is the air/fuel ratio table based on RPM vs MAP or MAF (engine load).

Spark table: This is the spark curve, again based on RPM vs MAP/MAF.

PE table: Power enrichment. This function acts as an accelerator pump and is based on TPS vs MAP/MAF. It's how much longer the

                injector(s) will pulse for when the throttle is stabbed to eliminate the dead spot.

OL ECT: Open loop engine coolant temp. This is the value at which the system goes into open loop and stops using the base maps

               which will be stored on either a separate ROM or in the processor.

AFR: You can actually change the air/fuel ratio here from 14.7:1 to whatever you want. Generally, there's no reason to unless you are

         trying to mix fuels, inject methanol or you're having trouble with a knock you can't get rid of.

Spark knock table: Also based on RPM vs MAP/MAF. This is how much advance the ECU removes when knock is detected.

 

There are some other tables and values to play with, but those are the main ones. Based on the physical engine design, I don't see more than a 10% gain in HP or mileage by tuning unless mechanical mods are made.

 

Wow. Love how the posting gave itself it's own indenting and sentence spacing. lol

Edited January 1, 2017 by skishop69

[DaveT]

Depending on which data sheet I look at, I see also that pins 4 & 5 may select modes.  The smaller data sheet I posted the part number matches 100%.  The big one covers many more ? or slightly different? ones. 

 

I just rechecked the 3 pins, 8,9,10 and yes, they are tied high by 1.00K resistors.

 

4 & 5 measure 4-6K  to either VCC or GND, so I'll have todo some sort of powered up test to determine them.

[DaveT]

Yes, the sheet I uploaded seems to indicate single chip mode too.  Maybe the EPROM is all tables?

[MR_Loyale]

In regards to the post you made in the other thread, I believe the intent here is to gain access to allow tuning. If that is the case, the things we should be able to change are as follows (and this is from memory as I haven't tuned anything OBD1 in years) :

 

AFR table: This is the air/fuel ratio table based on RPM vs MAP or MAF (engine load).

Spark table: This is the spark curve, again based on RPM vs MAP/MAF.

PE table: Power enrichment. This function acts as an accelerator pump and is based on TPS vs MAP/MAF. It's how much longer the

                injector(s) will pulse for when the throttle is stabbed to eliminate the dead spot.

OL ECT: Open loop engine coolant temp. This is the value at which the system goes into open loop and stops using the base maps

               which will be stored on either a separate ROM or in the processor.

AFR: You can actually change the air/fuel ratio here from 14.7:1 to whatever you want. Generally, there's no reason to unless you are

         trying to mix fuels, inject methanol or you're having trouble with a knock you can't get rid of.

Spark knock table: Also based on RPM vs MAP/MAF. This is how much advance the ECU removes when knock is detected.

 

There are some other tables and values to play with, but those are the main ones. Based on the physical engine design, I don't see more than a 10% gain in HP or mileage by tuning unless mechanical mods are made.

 

Wow. Love how the posting gave itself it's own indenting and sentence spacing. lol

 

Not my intent to tune anything at all but good information nonetheless. I mentioned you might want to peruse the ROM file to see if anything pops out as "tuner stuff" as you have put forth yourself as a tuning authority (or at least experienced) in OBD1 which no one else here knows about.  You would be most likely to recognize something like that hopefully.  We are simply collecting a bunch of facts about the ECU here at this point. It has a yellow connector,  a Hitachi CPU etc. Given your stated experience, the hope was if you look over it, something might pop up. Many unrelated facts, when put together can lead to new discoveries.

 

I am finding it fascinating. I am geeky that way, you will have to get used to it. I would never have thought that my Subaru has something in common with a freaking radio shack computer from the 80s! 

 

 

Would 8 K be overkill for OBD1 era basic engine control tables? I am thinking they probably did not have 3d tables and the like that far back as this was still new stuff back then.  One table I think we should be able to find is the one with the fault codes.

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

Yes, the sheet I uploaded seems to indicate single chip mode too.  Maybe the EPROM is all tables?

 

But if you look at the memory map for mode 7, all memory (RAM and ROM) is internal. The rest of the address space is listed as"unusable" which means to me that you cannot put an 8K EPROM in that space. That is the contradiction. Can you try to trace some of the pins from the EEPROM back to pins on the 6301? That might give us a clue as to how they put this together.

 

The example given in the handbook appendices for a mode 7 application is dot matrix printer controller.

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

Looking at it from a systems perspective, I cannot believe that the EPROM does not contain any of the controller code simply because of the economics of having to remask the 6301 at the foundry to fix a bug - which is what you would have to do if you used it in mode 7.  Probably the EEPROM also contains table data as well. 

 

Frankly, whether the EPROM contains table data or executable instructions is irrelevant at this point because in both circumstance, the EPROM must reside on an address bus in order to be read.

Edited January 1, 2017 by MR_Loyale

[MR_Loyale]

ECU PCB.jpg

 

ECU circuit board removed from case.  EPROM removed from the board.

 

Can you flip it over and take a pic of the bottom?

[DaveT]

Here is another data sheet reference I just found.  Memory pinout on pdf page 42.

 

http://bitsavers.informatik.uni-stuttgart.de/pdf/hitachi/_dataBooks/1982_Hitachi_Full_Line_Condensed_Catalog.pdf

 

I'll post a picture of the bottom side soon.

[DaveT]

Some address and data lines:

 

EPROM      CPU

D0  11          37

D1  12          36

D2  13          35

D3  15          34

D4  16          33

D5  17          32

D6  18          31

D7  19          30

 

 

 

 

 

EPROM      CPU

 A11  23       26

A10   21       27

A9     24       28

A8     25       29

 

I'm thinking these are high byte memory address lines.

 

A0 of the EPROM goes to pin 9 of the LS373 8bit latch  It's the Q4 output.  I haven't found where the D4 input is.  The damn conformal coating makes tracing by ohmmeter difficult.  I may just start removing more ICs.

[DaveT]

Solder side of ECU

 

[MR_Loyale]

DaveT,

 

How hard would it be for you to backtrace the trouble code LED and produce a small schematic ? Either it goes back directly to the 6301 or it has some support circuitry that then goes back to the 6301. I am thinking this may be helpful in correlating the subroutine for trouble code output to some port addresses and since there are only 128 bytes of RAM we can potentially look for opcode references to the RAM address space to help us out. The trouble codes are the only data that is volatile and there are not any external RAM chips.

 

Does this make sense?

[MR_Loyale]

DaveT,

 

In the assembly listing, the first things done are to clear locations 7F7F  and 7F7A. I am thinking these are hardware control registers of some sort as I know hardware registers in general do exist as there are references to a "Rate Mode Register" for setting the baud rate on the Serial Communication Interface (SCI). This is built in functionality on the cpu itself.

 

So if you happen to come across references to these addresses while reading, let us know. I wish this was a true PDF and not just scanned pages, the I could search the text. Anyway we could run this through an OCR progam to get searchable text?

[MR_Loyale]

Is there a crystal on there? I think I saw one one the lower left of the topside pic. Handbook makes references to baud rate selections in relation to different crystal frequencies of the main clock.

[MR_Loyale]

Just had a thought. If it is in mode7, that means there is internal ROM that is most likely the kernal of sorts. If what ANIM_Hooneru said was true, it may mean that Subaru had a precursor to the SSM in the EA82 cars. I would expect that functions related to this would be on the internal ROM.

 

If at some point we wish to read that internal ROM we could alter the board settings to a mode that would go to the EPROM and allow us to run some code piping the values out via the SCI as your EPROM reader is not able to read the internal ROM. Of course we would have to get some hardware built to do that. Potentially a data logger could be constructed at some future point using the SCI.

Edited January 2, 2017 by MR_Loyale