EA82 ECU experimenting

[MR_Loyale]

Let's start compiling a master chip list so we can at a glance associate a chip with a position on the pcb. I propose the following format:

 

 

IC#          Chip Number                          Description                      Datasheet link

-------------------------------------------------------------------------------------------------------------

IC12        HD14013BP                            Dual D type flip flop          http://www.harrisonelectronics.co.uk/datasheets/HD14013BP.pdf
 

Edited January 2, 2017 by MR_Loyale

[MR_Loyale]

I believe that IC3, NEC D449C-1 is some sort of RAM chip based upon my discovery of a similar chip number :

 

 

https://www.twistywristarcade.com/ram/1032-d449c-3.html

 

I think I found the datasheet for this:

 

https://www.digchip.com/datasheets/parts/datasheet/322/UPD449-pdf.php

 

 

 

 

 

Based on the description above, I believe this is where trouble codes live while the car is turned off. There may be other goodies stuffed in there as well.

Edited January 2, 2017 by MR_Loyale

[MR_Loyale]

IC 10  HA1835P

 

https://www.digchip.com/datasheets/parts/datasheet/740/HA1835P.php

 

The HA1835P and is a monolithic voltage regulator control designed for
microcomputer systems. In addition to the voltage regulator, it include
watchdog timer function and power-on reset function. These ICs can
perform many function in various microcomputer systems with few external
parts.

 

 

https://www.digchip.com/datasheets/parts/datasheet/740/HA1835P-pdf.php

[DaveT]

Yes, there is a crystal right there. I'll check the frequency. I have one of those plug in breadboards, so it is possible to pull a cpu and wire it up on one of those without having to spend for a PCB.

 

I can try tracing out the LED. I also want to figure out which wires on which connectors are power and GND.

[DaveT]

Yes, I suspected IC3 is RAM also. Just by the size and location. Yes, good idea to compile a table of the parts with data sheet links. I have downloaded the ones I've found, and the ones posted so far.

 

Are there any online ocr webpages?

[MR_Loyale]

Just discovered if you use adobe Reader 11, you can search entire handbook. I need to upgrade my reader.

[DaveT]

The CPU crystal is marked:

 

4000

SAWA-1

KSS50

 

I'll be able to measure the frequency once we have figured out power connections.

[DaveT]

The LED that blinks the trouble codes:

 

Driven by a 2sc458K Hitachi transistor.  E is grounded via a BLK / YEL wire in connector F107 that goes to the engine block GND.

 

The Base is driven by IC2 Pin2  [HD46520P]

[DaveT]

http://www.ic37.com/HD46520P-p.htm

 

This site seems to list the HD46520 - maybe old stock suppliers?  Couldn't find data sheets.  

 

HD46508 may be similar, but pin 2 is not an output, so it can't be drop in equivalent.

[DaveT]

ECU rom 1 asm list.txt

 

dis assembly listing of EPROM starting at address 0000 which may be wrong.

 

 

[MR_Loyale]

ECU rom 1 asm list.txt

 

dis assembly listing of EPROM starting at address 0000 which may be wrong.

 

 

 

I suspect this actually is data rather than code simply

because it is not in the address space (eg mode7) but rather it is

accessed by manipulation of the I/O pins which is what would normally be

the address lines become in mode 7.  There are four "ports" in Mode7,

three eight bit and one 5 bit port, I will have to look at where the

EPROM pins are going back (from your listing) to see which port it is

using.

 

I don't think that all 8K is data for a

single model as I don't believe this early setup was that sophisticated.

For example, you wouldn't need any tables relating to spark advance as

there is a distributor etc. Really the main task is monitoring TPS, CTS and O2 sensor and adjusting the output waveform to one or more injectors.

 

Because you have an 8K chip next to the 2K

static RAM, I suspect there may be up to 4 "base maps" that could be

loaded into static ram depending on the car options and heuristically adjusted.

Perhaps the four maps are Carbed, SPFI, MPFI and MPFI Turbo? Did MPFI always mean turbo?

Not sure.  Of course this is all speculation.

 

 

Our real challenge is to figure out how to read the internal masked ROM. I

am thinking there has to be a way because when these were ordered,

engineering samples were delivered for verification prior to a foundry

production run. They had to have a way to verify the code was what was

desired. If we can get that internal ROM read, we will be able to get

something useful to disassemble.

Edited January 3, 2017 by MR_Loyale

[MR_Loyale]

The CPU crystal is marked:

 

4000

SAWA-1

KSS50

 

I'll be able to measure the frequency once we have figured out power connections.

 

 

I am guessing that is a 4Mhz crystal because the literature says there is a divide by four circuit to give a system clock of 1 Mhz.

[MR_Loyale]

Looking at the note 2 on mode 0, it seems to indicate that you can briefly change the startup RES vector for testing purposes (eg verify the internal ROM using an external EEPROM).  Once FFFE and FFFF are read, it must disconnect from the databus within 3-4 cycles to avoid driving the databus with more than one device.  This is how an engineering sample would have been verified.

 

If we wanted to read the internal ROM we would need to remove the 6301 from the board and put it in a mode 0 configuration on a protoboard that was setup to apply our custom vector to our own routine to read the internal ROM. The vector would have to point somewhere to one of the external memory spaces where a an EPROM is connected. We could develop the program without any hardware using an emulator, burn it to an EPROM that gets placed into available memory space on the protoboard.

 

In order to redirect the RES vector we would need a circuit that would make our new vector available on the databus immediately upon RES and disconnect before 4 cycles. 

Edited January 3, 2017 by MR_Loyale

[MR_Loyale]

DaveT, can you do a trace of the pins between the eprom and the 2k static RAM chip? I suspect the latched A0 is acting as a map selector. 

Edited January 3, 2017 by MR_Loyale

[DaveT]

Ok, I'll check it those. I borrowed a better set of probes from work. Also start on removing the CPU.

[l75eya]

This is interesting. You guys we bored on NYE huh! Haha. Honestly though, this is very intriguing to follow. Wish I could help but I'm enjoying the thread!

[MR_Loyale]

How big is your protoboard? I know I can do a program to grab it if we can get the rest circuit done. But the we need to save the data off somewhere to make binary file that can be fed through the disassembler.

 

I am thinking using the SCI on the chip to allow a serial connection to a pc and capture the data that way.  I think there was example code in the handbook for this. This ain't no one nighters lol.

[DaveT]

 

There should be room.

Yes, this isn't a 1 night project.

More a bit late tonight...

 

 

[DaveT]

The RAM and EPROM -

Address low byte and data are wired parallel.
Address high byte also, except the EPROM has one more bit than the RAM.

 

 

CPU pin 37 wires to IC6 74LS373 pin 8 D4  This is data bit 0.

The Q from the latch IC6 is pin 9 This goes to the Address line A0

This makes sense, for a multiplexed address & data bus.  It is like the micromint processor systems I've wired up.

 

So port P3 [0-7] on the CPU is multiplexed Address low byte and data.

[DaveT]

I have also found that pins 9 & 10 [2 of the 3 mode select pins] on the CPU have 100nF capacitors to GND.  Reset Has a 10nF.  Those 2 will be low longer than reset.  Not sure if it would be long enough for it to read them as low at power up, but maybe?

[skishop69]

Ok, so I plugged the BIN into the tuner and as I figured, no go. The HEX converter didn't like it either. When I have more time, I'll sit down with it and one of my stock GM BINs and see what I can make out.

 

MPFI also came non turbo in 88. The maps that I mentioned will be in there somewhere including spark. It was an OBD1 requirement that the ECU be able to control spark and fuel to maintain emissions limits under all conditions.

[MR_Loyale]

Well, I did find this:

 

http://web.archive.org/web/20100301013019/http://www.vwrx.com/index.php?pg=selectmonitor

 

 

I am ordering parts to build this. As they seem to have an INI for 5MT N/A it would connect to my white car.

[robm]

Great fun, reverse engineering the CPU!

 

A few slight factual errors have crept in:

 

The TRS80 ran a Z80 micro, which was quite different to the Motorola 6800 series.  Although a friend of mine used to use Z80's in TRS80 cabinets for embedded control, the Motorola chips were way better suited to these applications  The instruction set is just way easier and more logical to use. 

 

Although the Loyale has a distributor, spark advance is still controlled by the CPU.  There is no mechanical advance mechanism to provide more spark lead with higher RPM, nor is there vacuum advance to reduce spark lead with load.  It all comes out of the microprocessor. 

 

I am watching this thread with great interest.

 

I have never managed to get my Loyales to ping, no matter what.  Even with 30 degrees of static advance, it didn't ping.  So I can't help but wonder if there is some gains in fuel consumption to be made by playing with the spark control?  I know my Datsun 510s got significantly better fuel consumption with a few extra degrees of static advance, at the cost of rattling like a can full of dimes when climbing hills, so I wonder what the EA82 could do with a remapped ignition?

[MR_Loyale]

Great fun, reverse engineering the CPU!

 

A few slight factual errors have crept in:

 

The TRS80 ran a Z80 micro, which was quite different to the Motorola 6800 series.  Although a friend of mine used to use Z80's in TRS80 cabinets for embedded control, the Motorola chips were way better suited to these applications  The instruction set is just way easier and more logical to use. 

 

Although the Loyale has a distributor, spark advance is still controlled by the CPU.  There is no mechanical advance mechanism to provide more spark lead with higher RPM, nor is there vacuum advance to reduce spark lead with load.  It all comes out of the microprocessor. 

 

I am watching this thread with great interest.

 

I have never managed to get my Loyales to ping, no matter what.  Even with 30 degrees of static advance, it didn't ping.  So I can't help but wonder if there is some gains in fuel consumption to be made by playing with the spark control?  I know my Datsun 510s got significantly better fuel consumption with a few extra degrees of static advance, at the cost of rattling like a can full of dimes when climbing hills, so I wonder what the EA82 could do with a remapped ignition?

 

 Though the original TRS-80 was a reference to the Zilog Z-80 processor upon which it was built, the later TRS80 Color computer (nicknamed CoCo) used the Motorola 6809 processor instructions set (similar to the Hitachi HD6301V1 in our Loyale ECU. ).  Tandy Corporation decided not to change the name to exclude the original 80 reference.

 

https://en.wikipedia.org/wiki/TRS-80_Color_Computer

 

You can see the connection between the Hitachi 6301 and the Motorola 6800 below:

 

The HD6301 was an 8-bit CPU designed using microcode to bring the simpler

design techniques of 16 and 32 bit CPUs at the time down to 8-bit designs.

Inspired by the Motorola 6800, the 6301

featured A and B accumulators, one stack and one index register. These,

along with the PC, were mapped to a bank of sixteen 8-bit registers

(R0L, R0H, R1L etc. up to R7H), which along with two data buffer registers

(DBR and DBL), and memory address registers (MARL and MARH), were accessed

by the microcode to execute the CPU instructions using one 8-bit ALU

and a simpler 8-bit arithmatic unit. A simple 2-stage pipeline was used.  -

 

SOURCE:

http://www.cpushack.com/CPU/cpu2.html

 

 

 

How does the CPU control spark advance on the EA82 engine? I see nothing in the wiring diagrams to indicate this. Could you please explain?

Edited January 4, 2017 by MR_Loyale

[crazyhorse001]

Once these maps are available, would they be compatible with the n/a "spider intake" xt ecu? I kinda doubt it, as that engine has an optical distributor. Not the reluctor setup the loyale used