Daewoo Lanos 1.5L Euro II - KDAC with ZXJN

[antus]

That ECU is a very interesting beast.. It has the same connectors as one of our '808s and is similar in size and design. Ive wondered what those 'blue' memcals are in, now thats answered. IIts interesting too that the chips on the main board say delphi, but the memcal says delco. As suspected the design appears is a newer revision of the same hardware/software we mainly deal with here.

I just installed ZXJN to a memcal here and tryed to run my car with it (2L, 4 cylinder). It didnt start (I guess having 1/4 of the required ram is probably a good reason for that!).

If you wanted to try you could try and start your car on one of our AMXY camira manual bins. Since our hardware is a lesser spec its possible (but unlikely) that it might work?

[L2-Max]

I have started disassembling. The main gpoal is to have full aldl info about modes.

I will report progress

[antus]

The serial interupt lands here, so thats the place to work from:

seg004:D341 ; =============== S U B R O U T I N E =======================================
seg004:D341
seg004:D341
seg004:D341 ; public SCISS
seg004:D341 SCISS: ; DATA XREF: USER_VEC:FFD6o
seg004:D341 ldx #$1000
seg004:D344 ldaa #4
seg004:D346 staa $2B,x
seg004:D348 brclr $2D,x $20 loc_D354 ; ' '
seg004:D34C brclr $2E,x $20 locret_D373 ; ' '
seg004:D350 bsr sub_D374
seg004:D352 bra locret_D373

[L2-Max]

I found two entries where aldl commands received.

The first one is wery simple, it process two modes:
0x05 and 0x06. Look at 0xD8BD in attached file.

It is exactly what I need. Mode 0x06 loads into memory user code and jump to subroutine at addres wich specified in first two bytes of aldl packet immediately. So, only info how to write flash memory is needed (I have attached second document where one people do that for hc11).

The second meke me confused. It is located at 0xD374. The aldl processing called from interrupt handler for each of byte received and use big amount of variables to store state, modes ... and has no hardcoded values. I just parse to place where modes is stored and couldnt get meaning how it read to be processed(think more time will help me ). It will be good to find out that modes, especialy writing to flash memory if it exist.

[L2-Max]

The big problem I couldnt identify the chip DELPHI 466 which connect flash memory to MCU. No datasheet was found

As it connected to external bus there should be flash registers to handle flash controller in memory space. Could someone help to identify the chip?

[L2-Max]

I have found datasheet which wery similar to my ECU flash controller. The chip is called:
PSD8XXFX
Flash in-system programmable (ISP)
peripherals for 8-bit MCUs, 5 V

From datasheet, I see that ports B and F are connected to proper PSD8XXFX address pins.

Could someone look at this controller and says some guess about relation to original Delphi chip?

[antus]

I dont think anyone will be able to help you with this. You'll need to check out the disassembly and see if the cpu uses it like you expect, or else use the data sheet to figure out a test that will show if the chip reacts how you expect.

Did you have any success yet with ALDL to read the mcu address space?

[L2-Max]

Yes, mode 2 is supported

[VL400]

Here is a disassembled file with all the correct routines and state machine lookups. Will start to work through a few things as i get a chance.

[L2-Max]

I see it not essentially differ form ZXJN. I had seen that memcal it was used for euro-0 daewoo 1.5 8V. But I be mistaken.