Jump to content


Welcome to Ultimate Subaru Message Board, my lurker friend!

Welcome to Ultimate Subaru Message Board, an unparalleled Subaru community full of the greatest Subaru gurus and modders on the planet! We offer technical information and discussion about all things Subaru, the best and most popular all wheel drive vehicles ever created.

We offer all this information for free to everyone, even lurkers like you! All we ask in return is that you sign up and give back some of what you get out - without our awesome registered users none of this would be possible! Plus, you get way more great stuff as a member! Lurk to lose, participate to WIN*!
  • Say hello and join the conversation
  • Subscribe to topics and forums to get automatic updates
  • Get your own profile and make new friends
  • Classifieds with all sorts of Subaru goodies
  • Photo hosting in our gallery
  • Meet other cool people with cool cars
Seriously, what are you waiting for? Make your life more fulfilling and join today! You and your Subaru won't regret it, we guarantee** it.

* The joy of participation and being generally awesome constitutes winning
** Not an actual guarantee, but seriously, you probably won't regret it!

Serving the Subaru Community since May 18th, 1998!

Guest Message by DevFuse
 

Photo
- - - - -

EA82 ECU experimenting

ROM processor ECU

  • Please log in to reply
101 replies to this topic

#1 DaveT

DaveT

    Subaru Nut

  • Members
  • 3,523 posts
  • Colchester

Posted 29 December 2016 - 07:28 PM

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.
Object code compatible with 6801 family.

 

 



#2 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 29 December 2016 - 09:13 PM

I wonder if a Motorola 6800 decompiler would work.


Edited by MR_Loyale, 31 December 2016 - 04:40 AM.


#3 DaveT

DaveT

    Subaru Nut

  • Members
  • 3,523 posts
  • Colchester

Posted 29 December 2016 - 09:30 PM

Attached File  HD6301V1P processor Data Sheet.pdf   1.52MB   11 downloads

 

Here is the data sheet.

 

It mentions compatibility with the HMCS6800 family.

 



#4 DaveT

DaveT

    Subaru Nut

  • Members
  • 3,523 posts
  • Colchester

Posted 30 December 2016 - 04:56 PM

Attached File  Subaru GL Loyale ROM.txt   19.26K   15 downloads

 

This is a text file [hex] of the ROM

 

I can send a .bin file of it, but apparently, not through the message board.

 

 



#5 skishop69

skishop69

    If it ain't broke, you're not trying.

  • Members
  • 1,478 posts
  • Puyallup

Posted 30 December 2016 - 09:26 PM

Ok, so in regards to my post in the other thread.... Great! You were able to read the ROM! We still need someone who knows or can deconstruct the coding for the processor so we know which parts of that hexadecimal log can be safely altered. Without that coding, we have no way of knowing how to alter the log.

 

PM me so you can send me the BIN and I'll try plugging it into a tuning program to see what happens. Maybe we'll get lucky, but I'm not holding my breath.


Edited by skishop69, 30 December 2016 - 09:28 PM.


#6 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 03:54 AM

Been a while since I worked with 6800 opcodes and operands. I have worked with 68HC11 protoboards so if this bears any resemblance it may be possible. I will give it a look.

 

If this is a Motorola 6800 based instruction set the data is in big endian format. Still looking at the manual.


Edited by MR_Loyale, 31 December 2016 - 05:54 AM.


#7 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 04:05 AM

Here is the link to the 6301 series handbook with hardware, software techniques:

 

http://www.jaapsch.n...-3_handbook.pdf



#8 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 04:47 AM

So looking at this, I am thinking that the CPU instruction set is based upon the Motorola 6800. If this is true, there should be assembler/editor programs. Hitachi may have licensed this and produced their own chips.

 

Here is my reasoning for thinking this, please sanity check this out:

 

From the HD6301V1P datasheet, go to scanned page 63 (23 in your pdf reader) and look at table 8 where the opcodes are listed.

 

Then open this link for the Motorola instruction set

 

http://www.lucidtech.../6803_instr.pdf

 

I do a quick comparison of the accumulator A  ADD instruction (ADDA) and it appears to me that they have the same hex designation in all the five addressing modes.  Can someone else independently confirm?

 

Update: Came across this wikispace on the 6800 and it also lists a Hitachi 6301 controller version.  I think Hitachi licensed the 6800 architecture and adapted it for industrial and hardened environments. They also added 6 extra instructions including a sleep (slp).

 

https://chessprogram...spaces.com/6800


Edited by MR_Loyale, 31 December 2016 - 05:56 AM.


#9 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:14 AM

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.
Object code compatible with 6801 family.

 

 

Can you give me some more info on the txt output format of your reader? How many bytes to the right of the colon are the address indicators? Or is it assumed from address 0000? This is a critical detail.


Edited by MR_Loyale, 31 December 2016 - 05:15 AM.


#10 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:20 AM

Here is a nice little intro to 6800 assembly langauge programming:

 

http://www.hvrsoftware.com/6800.pdf



#11 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:37 AM

More evidence this may indeed be the same Motorola 6800 instruction set:

 

"After the 6800 project Bennett worked on automotive applications and
Motorola became a major supplier of microprocessors used in automobiles." 

 

https://en.wikipedia...i/Motorola_6800



#12 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:42 AM

This is a thread to track whatever we discover regarding  ECU internal wiring / code / experimenting.

Dark color coating the external metal box.  From an EA82 4x4 Wagon. 

ECU is labeled:

 

22611 AA100

MECF-001

5Y14

 

The UV erasable EPROM is a Hitachi HN482764G.

8K x 8 28pin Ceramic DIP

 

The CPU is a Hitachi HD6301V1P

1MHz 8 bit 5V CPU I have the data sheet. Includes the Op codes.
Object code compatible with 6801 family.

 

 

What is the packaging of the HD6301V1P? Dual inline or square?  Are there any other RAM or ROM chips? We may need to do some tracing on the address bus to the ROM chip to see where in the address space the ROM lives. I suspect it is in the lower 8K as the 6800 starts program execution at address 0000.

 

EDIT: Actually our processor gets it's starting address from the RES vector at the end of the memory map ($FFFE and $FFFF).


Edited by MR_Loyale, 01 January 2017 - 05:04 AM.


#13 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 07:04 AM

We should be able to identify subroutines by searching for JSR (jump subroutine $90) opcodes and their endpoints with the RST ($38)opcodes. This would help in delineating code regions from data regions.

 

EDIT: The disassembler claims it can do this for us.


Edited by MR_Loyale, 01 January 2017 - 05:05 AM.


#14 DaveT

DaveT

    Subaru Nut

  • Members
  • 3,523 posts
  • Colchester

Posted 31 December 2016 - 07:14 AM

The processor is 40 pin dip. I'll try looking up the other 2 good sized chips near the processor and EPROM. I'll have some time later today.

#15 DaveT

DaveT

    Subaru Nut

  • Members
  • 3,523 posts
  • Colchester

Posted 31 December 2016 - 04:51 PM

Other ICs - Hitachi HD46520P  40pin DIP, right alongside of the processor. 

 

NEC D449C-1  24pin DIP along side of the EPROM.

 

So far, I haven't been able to find any information on these 2.

 

The 6301 history ideas above make sense to me.
 

In the text HEX file, The leading :20 is ignored.  using the first line as reference, the address is the next group of numbers, the 00 [first data byte] is 7F.  Looks like 32 bytes per line.



#16 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:01 PM

Looking at some documents from Hitachi regarding the processor, it apparently could be ordered with onboad eprom masked in at time of manufacture.  So some of the actual coding may be onboard the processor chip itself, It would make sense though that any sort of car model specific stuff would be on an external UV erasable chip in case a bug was found, new regulations happened , recall etc. 

 

Are there possibly any ports that may be a diagnostic port (possibly an RS232 used for QC)?


Edited by MR_Loyale, 31 December 2016 - 05:11 PM.


#17 skishop69

skishop69

    If it ain't broke, you're not trying.

  • Members
  • 1,478 posts
  • Puyallup

Posted 31 December 2016 - 05:11 PM

So looking at this, I am thinking that the CPU instruction set is based upon the Motorola 6800. If this is true, there should be assembler/editor programs. Hitachi may have licensed this and produced their own chips.

 

Here is my reasoning for thinking this, please sanity check this out:

 

From the HD6301V1P datasheet, go to scanned page 63 (23 in your pdf reader) and look at table 8 where the opcodes are listed.

 

Then open this link for the Motorola instruction set

 

http://www.lucidtech.../6803_instr.pdf

 

I do a quick comparison of the accumulator A  ADD instruction (ADDA) and it appears to me that they have the same hex designation in all the five addressing modes.  Can someone else independently confirm?

 

Update: Came across this wikispace on the 6800 and it also lists a Hitachi 6301 controller version.  I think Hitachi licensed the 6800 architecture and adapted it for industrial and hardened environments. They also added 6 extra instructions including a sleep (slp).

 

https://chessprogram...spaces.com/6800

Oh my brain hurts. I'm way past rusty. For what it's worth, it does appear the hex designation is the same. That's about as much help as I'm going to be for that portion. lol As for the address space, 000F seems to stick in my brain, but that would be in regards to whatever PROM GM was using back then and I can't check that until Tuesday which is when I'm going to try and plug the BIN into a tuning program just for gits and shiggles.



#18 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 05:32 PM

Other ICs - Hitachi HD46520P  40pin DIP, right alongside of the processor. 

 

NEC D449C-1  24pin DIP along side of the EPROM.

 

So far, I haven't been able to find any information on these 2.

 

The 6301 history ideas above make sense to me.
 

In the text HEX file, The leading :20 is ignored.  using the first line as reference, the address is the next group of numbers, the 00 [first data byte] is 7F.  Looks like 32 bytes per line.

 

 

I think the Hitachi HD46520P  40pin DIP is an A/D converter based upon searches for this I was directed to the spec sheets for the HD46508 which may be a substitute or one in the same family of "Analog Acquisition Units" as they call them:

 

http://kazus.ru/data...HD46508A-2.html

 

Possibly this is used to digitize sensor inputs such as the TPS and CTS. Some following of the board traces to where they emerge to a connector may give a clue as we can identify the wires coming from both and their connector to the ECU box.


Edited by MR_Loyale, 31 December 2016 - 05:34 PM.


#19 ANIM_Hooneru

ANIM_Hooneru

    Advanced Member

  • Members
  • PipPipPip
  • 39 posts
  • Casino, NSW, Australia

Posted 31 December 2016 - 05:57 PM

Hey fellas,

What an interesting topic! Its way above my understanding level, but i'm going to be following anyway.

 

MR_Loyale, in regards to a RS232 port, I stumbled upon an interesting site the other day when I was doing some Subaru Select Monitor research for my EJ22 swap. The site is here. http://www.alcyone.o...m/protocol.html

Also check out the headings "How to build a PC adaptor" and "Eavesdroping"

 

That site covers how to make an RS232 connector to use a PC as a SSM, I would imagine with a bit of creativity and a donor harness you could rig it up to get into an ECU outside of a car, or alternatively find the SSM Plug on the vehicle and use that.

I have a 1986 Leone Turbo Auto (Australian edition of course) that I can whip the ECU out of to check out as well. Would be nice to get an archive of numbers and all that.


Edited by ANIM_Hooneru, 31 December 2016 - 05:58 PM.


#20 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 09:29 PM

Found a nice hex editor here:

 

http://www.handshake...nload/xvi32.zip

 

 

I have opened the bin file and I can see areas that are most likely data storage areas for settings of some sort as they have repeating values that would not be opcodes and operands simply due to their repetition.  If we all use the same hex editor with rows arranged in a similar way we can discuss values at addresses using the same point of reference.

 

Here is what it looks like:

 

hexeditbin.jpg

 

It shows an address for the first byte of the row in the first column. Next are 16 columns showing hex values for each byte. Finally an ASCII representation is shown in the right 16 columns. If there are any human readable strings, they will show up in the ASCII area (maybe Subaru or Leone or something).


Edited by MR_Loyale, 31 December 2016 - 09:43 PM.


#21 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 09:34 PM

Here is another useful tool, a 6800 family disassembler. The disassembler takes as input a binary code/data image
file (typically a ROM image) and generates either an assembler source file or a listing file.

 

Here is a link:

 

http://myweb.tiscali...k/pclare/DASMx/

 

Reading through the instructions, it does claim to do Hitachi 6301. This is a command line tool folks, no fancy GUI for you!  I will see if I can get a listing out of this, It also claims to be able to do code threading (eg identify regions of code rather than data).


Edited by MR_Loyale, 31 December 2016 - 09:41 PM.


#22 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 09:52 PM

Here is a fun fact, our old Subarus use almost the same microprocessor as the TRS80 Color Computer. Who ever used one of those? Raise your hands.



#23 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 10:03 PM

Also I want to investigate where in the address space the memory mapped I/O lives. Those will be key to finding the code that reads the TPS and CTS and such.



#24 MR_Loyale

MR_Loyale

    22 Years of Ownership. 94-16

  • Members
  • 1,513 posts
  • Seattle

Posted 31 December 2016 - 10:14 PM

Hey fellas,

What an interesting topic! Its way above my understanding level, but i'm going to be following anyway.

 

MR_Loyale, in regards to a RS232 port, I stumbled upon an interesting site the other day when I was doing some Subaru Select Monitor research for my EJ22 swap. The site is here. http://www.alcyone.o...m/protocol.html

Also check out the headings "How to build a PC adaptor" and "Eavesdroping"

 

That site covers how to make an RS232 connector to use a PC as a SSM, I would imagine with a bit of creativity and a donor harness you could rig it up to get into an ECU outside of a car, or alternatively find the SSM Plug on the vehicle and use that.

I have a 1986 Leone Turbo Auto (Australian edition of course) that I can whip the ECU out of to check out as well. Would be nice to get an archive of numbers and all that.

 

 

If I ever do EJ stuff, that is the site I will start at. Those ECU's are in a different league compared to these old school ECU's  What was the precursor to Subaru SSM?



#25 Crazyeights

Crazyeights

    Crazyeights

  • Members
  • 1,462 posts
  • Pacific Northwest

Posted 31 December 2016 - 10:35 PM

I have the equipment to erase and re-program (burn) most older UV EPROMS like the 2764 ect. I'll volunteer to try and help if someone gets as far as needing a set of EPROMS burned.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users