PCMTec Development Blog

Ford information and tools can be found here
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: Ford MPC565 Tuning

Post by Tazzi »

kojab wrote:
Champion stuff!!

Wow looks like you actually pulled off the MPC555 from the board?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: Ford MPC565 Tuning

Post by Tazzi »

Right so it looks like we have:

Motorola xc431622 - 16bit MCU with Flash 912B32 : http://download.siliconexpert.com/pdfs/ ... owfals.pdf

MPC555 - Main processor: http://www.nxp.com/products/microcontro ... ers:MPC555

ST M58B8AUTO, cant find this one online well, have sent in a few requests for data sheets. But, based on the bin sizes (1.5mb ish) there looks like two similar products:

External flash 256kb x32: http://pdf1.alldatasheet.net/datasheet- ... BF008.html
or
External flash 512Kb x32: http://pdf1.alldatasheet.net/datasheet- ... 016BB.html

Im thinking its the later.. since.. well.. that makes 2mb which fits the full bin.

An finally the Motorola SC370752FN... no idea what the hell that is.. Have requested multiple places that sell the item for the datasheet.

Two main items of interest would be the MPC555 and external flash (M58B8AUTO). Now... just have to see where all the pins go....

*Edit
Hmmm.. not seeing much about that particular flash. Custom algo would need to be developed to support that flash with the MPC555 using the debug interface.
Otherwise trying others from the same manufacturer as they tend to use the same 'commands' throughout all their designs.
The MPC555 does also have some internal space to look at.. be interested to see whats stored there (If anything).

No clue what that other MCU does.. transmission???
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 408
Joined: Wed Sep 07, 2016 1:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Regarding accessing the external flash that is usually very easy. I've written about 4 different ones in c before. The commands you send are actually suspiciously similar to the commands to send via uds to erase/write the flash. I suspect it is simply a passthrough routine from obd to spi or whatever the chip uses.

What are you trying to determine tazi, how to find the bdm debug pins?
User avatar
rolls
Posts: 408
Joined: Wed Sep 07, 2016 1:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Also I'm back from Bali on the 31st,then I have until the 1at of Feb to work on the editor. I hope I can have an alpha ready then but no promises. If I'm not happy by that date probably be more like April I'll have a release ready.

I've also got the website and api finished now. Api is used for licensing and downloading address templates for editing/datalogging.

The other bloke I'm working with (he is a lurker on here) is working hard on the templates and content. Content will include help for each table/parameter with maths equations showing how the PCM uses the maps etc. I hope to have a program with enough explanations that no one needs use google or forums to understand what to change and when.

Most likely going to give it for free initially to some select people for alpha testing. Then we will be charging around the $100 per car mark. Should be very affordable compared to sct and hpt as you only need the $200 open port and a $100 license.

Undecided about the one off/subscription pricing for extra features (pats bypass, vin change etc) and support.

Excited!
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: Ford MPC565 Tuning

Post by Tazzi »

rolls wrote:Regarding accessing the external flash that is usually very easy. I've written about 4 different ones in c before. The commands you send are actually suspiciously similar to the commands to send via uds to erase/write the flash. I suspect it is simply a passthrough routine from obd to spi or whatever the chip uses.

What are you trying to determine tazi, how to find the bdm debug pins?
Wouldnt be surprised if they tried to keep it as similar as possible in that regard.

Yeah, essentially the ability to recover the flash in the event of completely and utterly destroying it from bad flash or putting in wrong OS ect. Will make for a good test dummy for seeing which OS's really are compatible, or testing anything new if you go down the road of allowing full flashes. Will be more than happy to see what will cause a real brick then :lol:

Be nice if they were the basic SPI interface, would just clip directly to the flash and bypass the MPC555.
These flash chips use OE, WE, Address inputs, data in/out ect. Iv given it a whirl before on similar style chips with a little bit of success (Pulled off of board and onto custom interface). Essentially the entire flash has to be connected to.

So that being the case.. easier just to hitup 5ish connections for bdm. 8-)
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
80gus
Posts: 139
Joined: Wed Jun 08, 2016 10:56 am
Location: Brisbane QLD

Re: Ford MPC565 Tuning

Post by 80gus »

Tazzi wrote:
rolls wrote:Regarding accessing the external flash that is usually very easy. I've written about 4 different ones in c before. The commands you send are actually suspiciously similar to the commands to send via uds to erase/write the flash. I suspect it is simply a passthrough routine from obd to spi or whatever the chip uses.

What are you trying to determine tazi, how to find the bdm debug pins?

Yeah, essentially the ability to recover the flash in the event of completely and utterly destroying it from bad flash or putting in wrong OS ect. Will make for a good test dummy for seeing which OS's really are compatible, or testing anything new if you go down the road of allowing full flashes. Will be more than happy to see what will cause a real brick then :lol:
IVe tried my hardest to crash one of these thing, BA-FG I cant crash one any O/S ect. i like the idea of a full flash tho 100% clone would make replacment ecus so much easier.
Rolls keep up the good work there iss a few of us watching the progress. will you have the ability to do real time scanning with your tuning program, and simple copy past tables?
User avatar
rolls
Posts: 408
Joined: Wed Sep 07, 2016 1:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Map tracing, compare, copy paste etc will all be there at some point.
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: Ford MPC565 Tuning

Post by Tazzi »

80gus wrote:IVe tried my hardest to crash one of these thing, BA-FG I cant crash one any O/S ect. i like the idea of a full flash tho 100% clone would make replacment ecus so much easier.
Rolls keep up the good work there iss a few of us watching the progress. will you have the ability to do real time scanning with your tuning program, and simple copy past tables?
They have been all calibration changes if Im not mistaken? Good to hear they are pretty much bullet proof with cal changes!

Its the OS change Im thinking of.. or a perfect 'clone' (Full write) which I think is the risky one if shit hits the fan. Be nice to recover them.

Do any of the major tuning companies have custom OS's for the Ford ECU's?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 408
Joined: Wed Sep 07, 2016 1:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Hptuners have a mod to allow 3bar boost sensor, whilst it isn't a huge modification it is technically a custom OS.

If anyone has another spare bf /fg ecu I can test doing a full 100% write and confirm what will and won't brick it.

Don't really want to put it in the software until I've tested it personally myself as the last thing I want is people accidentally bricking a pcm.
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: Ford MPC565 Tuning

Post by Tazzi »

rolls wrote:Hptuners have a mod to allow 3bar boost sensor, whilst it isn't a huge modification it is technically a custom OS.

If anyone has another spare bf /fg ecu I can test doing a full 100% write and confirm what will and won't brick it.

Don't really want to put it in the software until I've tested it personally myself as the last thing I want is people accidentally bricking a pcm.
Realistically.. cant see why anyone would need/want to change OS unless wanting to make a backup/spare ECU for a car.
I know Id want a spare one for the XR8 :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image