Reverse Engineering P59 HWID 12575502

[bubba2533]

I am trying to determine how the circled chip communicates with the main MCU.

And if anyone would be able to help me ID the chip that would be great.

The board I'm looking at is an Intel P59. Pretty sure the hardware number is 12575502

I've traced the chip to be connected to the ignition coil pins, which I am trying to do some reverse engineering of the logic for the ignition control.

I'm having trouble understanding how the MCU communicates with peripheral chips. I understand there are chip select pins and address pins, but I am having a hard time searching for info as I don't know the terminology very well so I could use a point in the right direction. I've tried to read the MCU data sheet, but parts of it really goes over my head.

[antus]

I think it is more than that. I think the chip above it, the 48699, is in between it an the cpu. You really need to understand how that one works. I think its also involved in the control of the WE pin for flashing. There are some registers the cpu writes to, to control it, but its quite hard to figure out. Sorry I dont have more.

[bubba2533]

Yeah, I was afraid it was going to be more difficult than that. Has anyone determined what chips those are?

I haven't even seen anyone post what the main CPU chip is. The only one that I have found so far is the MC68336/376 datasheet which is a 160 pin chip like the one in this PCM.

[bubba2533]

After looking at the datasheet some more it definitely looks like the main MCU is a MC68336.

MCU Datasheet to make sure it's easy to find if anyone wants to take a look.

MC68336376UM.pdf

(7.42 MiB) Downloaded 202 times

Something I noticed previously is this has 10 bit ADC inputs, but the code shifts the data to 8 bit for all of the inputs. Random thing I thought was interesting because they are just throwing away precision on the inputs. I imagine it was done for ease of implementation.

[antus]

Get the 80mb zip from here. Its the manufacturer docs for the platform. It might be in part customised and of course GM have their OS on top of it, but its the best reference I have found. Its essentially the right dev/kit platform. filename MPC500_M68300_CD_ZIP.zip

https://www.nxp.com/products/processors ... eet&fpsp=1


In particular MC683XX\mc68332\c5sim.pdf which I'll attach here covers the chip selects.

[bubba2533]

Ok thanks! That helped point me to something I glossed over.

[kur4o]

I traced some of the pins on that chip, since it is used on v6s pcm and early style ls1 and maybe others.
It also filters the crank, cam signals and send them to processor, it can be configured to run in different modes, single coil v8, dis module v6, 8 coils and so on.
ON v6s pcms there are some pins wired to pcm connector, for 6 Coil on plug style, but not sure how that can be turned on, is it software limitation or there is also some hardware too.

[bubba2533]

Yeah, I haven't been able to trace it to the injectors but I imagine it could be controlling those as well.

This same PCM controls V6 distributor (3 tooth crank trigger), V8 distributor (4 tooth crank trigger) and V8 individual coil engines (24x LS style trigger) with the same OS. So at least that much can be changed from just software.

I would love to be able to find more on what these parameters are and if it's possible to configure them to allow individual coil control on the distributor style crank triggers.

I think being able to identify those two chips and finding datasheets would be essential to figuring out how to do so. Otherwise I'll be doing random changes and bench testing to see what I get.

[bubba2533]

Another thing that makes it quite difficult is that anything that I try to log in that area comes back as nothing but zeros.

If I could figure out how to log that range I could use that to help determine what some of the variables are used for.

Edit:
The range I'm trying to log starts at 0xFFFFE000 and I've tried to log addresses up to 0xFFFFE0D6 and all of them have returned zeros.

[bubba2533]

Ok, so I've gotten around the logging issue. I patched in some code to copy the Ram addresses that I was interested in to some Unused Ram in a different location. It worked, but it really didn't gain me that much.

I haven't been able to find any datasheets that look similar to either of those chips. I'm running out of ideas and I really want to figure this out.

I started tearing down a board to be able to trace the pins, but that's going to take a long time.