Reverse Engineering P59 HWID 12575502

[Big ‘G’]

We’re you able to determine how main mcu communicates with that chip? Spi or shared ram

[turbo_v6]

We’re you able to determine how main mcu communicates with that chip? Spi or shared ram

The biggest issue is that I was never able to find any documentation on the chip.

I'm thinking it's communicating via shared ram.

[antus]

This was shared with me some time ago. I cannot vouch for its accuracy but it seems to document that it uses a combination of shared ram, temporary ram, and registers if it is for this chip. The functions look about right. I believe the addresses are offsets from a base address, similar to how other chips such as the DLC work when comparing to the freescale documentation.

Code: Select all

// Shared RAM
xxx000,DFPW
xxx010,Old_HI
xxx018,G_PERIOD_USED
xxx01C,EOIT_LOC
xxx020,EOIT
xxx030,PWMHI
xxx038,Actual_Dwell
xxx03C,EOIT_FRAC
xxx040,Cam_History
xxx042,RISEC
xxx05C,TACH_Hi
xxx05E,TACH_Lo
xxx060,ESCSEL_Pattern
xxx062,FallC
xxx07C,Bound_Time
xxx07E,TDC_Offset
xxx080,Mux_Change
xxx082,R_Count
xxx09C,EST_Control
xxx09E,Dwell2
xxx0A0,WinGate_KTime3
xxx0A2,Cyl_ID
xxx0A4,Max_Dwell
xxx0A6,Min_Dwell
xxx0A8,Ion_Gap_Lo_Res_Buff
xxx0AA,Ion_Gap_Low_Buff
xxx0AC,LAST_PER
xxx0AE,Lo_Res_TimeO
xxx0B0,Fall_Cnt
xxx0B2,KINJ
xxx0B4,Min_INJ_Off
xxx0B6,Min_Trim
xxx0B8,New_Fall_Cnt
xxx0BC,Med_Per_Lo
xxx0BE,Ion_Gap_Low_Time
xxx0C0,WinGate_KTime4
xxx0C2,Bound_Frac
xxx0C4,Med_Res_TimeO
xxx0C6,Min_Burn
xxx0C8,MResPer
xxx0CA,Unused_Reg_0CA
xxx0CC,Lo_Res_Accum
xxx0CE,Discrete_Out_H
xxx0D0,Discrete_Out_L
xxx0D2,Cyl_ID_Max
xxx0D4,Max_Pos
xxx0D6,Fuel_Control
xxx0D8,EST_Fall_Time
xxx0DC,NT_NUM
xxx0E0,ROM_Revision_ID
xxx0E2,F_Count
xxxFC,Fuel_Accum

// TFD Registers
xxx100,TFDCR TFD control reg
xxx102,STBR short to batt reg
xxx104,STGR short to ground reg
xxx106,TCFIO TCFIO disc inputs reg
xxx108,TCI TCI disc inputs reg
xxx10A,TCIO TCIO disc inputs reg
xxx10C,DMR drain monitor reg
xxx10E,DMLDR drain monitor logic disable
xxx110,Unused_Reg_110
xxx112,DIDR disc input data reg
xxx114,Unused_Reg_114

// TIO Temporary RAM Registers
xxx0180,AFPW
xxx0190,TEMPPWM
xxx0198,ESTTemp
xxx019C,WRef_Time
xxx019E,TACH_Cnt
xxx01A0,FuelTemp
xxx01B0,PWMPER
xxx01B8,Rise_Time
xxx01BC,NT_EOIT
xxx01C0,WINGATE_Temp
xxx01C2,EST_F_COUNT
xxx01C4,Unused_Reg_1C4
xxx01C6,W_Ref
xxx01C8,P_Cnt24x
xxx01CA,P_Cnt0_Intr
xxx01CC,Lo_Res_Period
xxx01CE,Result
xxx01D0,MR_Int_Delay
xxx01D2,Unused_Reg_1D2
xxx01D4,Unused_Reg_1D4
xxx01D6,Unused_Reg_1D6
xxx01D8,EST_Rise_Time
xxx01DC,ESTPCnt
xxx01DE,MResTim
xxx01E0,ESCSEL_Time
xxx01E2,Lo_Res_Time
xxx01E4,Timer
xxx01E6,IX_Bound
xxx01E8,LoRPCntF
xxx01EA,LoRPCnt0
xxx01EC,Incr_PCnt
xxx01EE,M_Cnt
xxx01F0,TDC_PCNT
xxx01F2,Unused_Reg_1F2
xxx01F4,PCNT_Fall
xxx01F6,LRStart
xxx01F8,Next_PCnt0
xxx01FA,Num_Chans
xxx01FC,NT_IX

// Remaining TIO Registers
xxx200,TTRAM
xxx250,Reserved_00
xxx280,ITRAM
xxx2A0,Reserved_01
xxx2C0,T0
xxx2C2,Counter
xxx2C4,Reserved_02
xxx2D0,Req_Flags_0_to_15
xxx2D2,Req_Flags_16_to_31
xxx2D4,Req_Flags_32_to_39
xxx2D6,Reserved_03
xxx2E0,IR
xxx2E8,Reserved_04
xxx2F0,TCR
xxx2F2,Reserved_05
xxx2F4,FLR
xxx2F6,Reserved_06
xxx2F8,DDR
xxx2FA,DR
xxx2FC,CKR
xxx2FE,CR
xxx300,Reserved_07

[Big ‘G’]

ANTUS this is off topic I’m trying to log in from a different computer but my user name is not recognized and contact the administrator is disabled. Any suggestions

Ive always leaned towards Spi, based on a cic document I’ll share if i can ge logged in on my laptop. But going through the code anti may be correct

[antus]

It looks like your username has smart quotes not normal quotes (signed up on an apple?) try copy pasting your username.

[Big ‘G’]

Based on this doc i lean towards spi. hope this helps

[turbo_bu]

Based on this doc i lean towards spi. hope this helps

Great document. Do you happen to have a copy with all the pages? This one stops after page 68.

[turbo_v6]

Based on this doc i lean towards spi. hope this helps

This is a very interesting document. Looks as though it confirms that the 24x is embedded into the chip. I'll keep reading, but that's what it seems like so far.

[antus]

That explains why it looks like the code goes no where for a different trigger in the operating system code.

[AngelMarc]

Based on this doc i lean towards spi. hope this helps

I wonder if the "bypass mode" where the IC doesn't filter, could be the thing changed by engine_schedule_RPM.
Description is vague. Shot in the dark. More guesses as I read.