Reverse Engineering P59 HWID 12575502

[AngelMarc]

"The digital filters of the CIC have a 500 nanosecond (500 nsec.) resolution. This is 2x the
internal IC clock rate. The reference signals are synchronized to this clock rate before entering
the digital filter logic."
So 4 megahertz clock on that IC.

EDIT: 1MHz. I did something backwards

[AngelMarc]

Ok, signed (+/-) start at zero, count down when low, up when high, move MSB of counter (for the +/-) each time signal goes low, into a shift register.
I knew it had to be a list of 1s and 0s, but I love this simple thing that can likely be done with common arduinos.
A little validation on a theory is nice every now and then. Great read.

[AngelMarc]

Well, there's the thing to go for waste spark/2 stroke use.
EDIT: and let's not forget V12 waste spark.

[AngelMarc]

Curious if enough of the I/O is known to allow starting from scratch on the code.

[V8fan]

This 24x strange pattern tone wheel looks to me same as fuel injectors locked inside intake plenum with plastic hoses instead solid rails
Just experiment that proves that 58x tone wheel better

[AngelMarc]

Can you explain how it's better? Have you seen the details of figuring out sync on various ECUs that use it? Or did you just see complexity and cringe? They're all complex.

[V8fan]

Can you explain how it's better?

All manufacturers use now 58x for 0-7000 rpm engines

[AngelMarc]

And? All car manufacturers are using bullshit thin oil too.

[AngelMarc]

24x without a cam sensor only needs 90 degrees to sort out crank position.
58x only gets close to that with the 4x cam sensor.

[NSFW]

Curious if enough of the I/O is known to allow starting from scratch on the code.

I don't think so, but I also don't think it would be an insurmountable problem if you're motivated. There are basically two ways to approach it:

1) From software: For a given input or output pin, find the code that reads from it or writes to it... For a lot of the IO pins, you could start with a corresponding OBD2 PID, find the code that reports that PID, look at the memory location that it reads from, and then look for code that writes to that memory location.

2) From hardware: follow the traces from that pin to the CPU, look at the datasheet to find out what registers are used to read or write to that pin, and then look for code that reads or writes those registers.

Either way you'd want IDA or Ghidra of course. And it will take time.

The flash kernels have the VPW communication stuff implemented, as well as watchdogs. You could make small changes to them to add code that reads or writes whatever IO registers you are interested in, so that you could test your IO code without even writing to flash memory.

It should also be possible to get the m68k version of gcc to produce binaries that you could flash to the PCM, though you'd want to use BDM for testing that.