RhinoPower Ltd

Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: 76C55 (MH6311) information


Guru

Status: Offline
Posts: 1291
Date:
76C55 (MH6311) information
Permalink  
 


Bob wrote:

 

You must have quite a bit of experience to be able to figure out how to go about setting up a rig like that, Do you do much of that type of work for a day job ?

Also how come you use eprom and not eeprom chips ?


 Back in the old days we had to write assembly code and debug with a logic analyser, I did a fair bit. I quite enjoy playing with these old chips, they are so simple. An Aurix, which is typically used in a modern ECU has around 1000 registers just for the timer module! At least with the LA you can do real time code tracing and code mods so its still superior to an Arduino!

The original boards were EPROMs, I did use the old 27SF EEPROMS a few years back but you can only get poor quality counterfeits these days from places like AliExpress, sometimes they work but for how long is anyone's guess. I have in the past modified a board to take a 28HC256 EEPROM but they are expensive now. Its cheap to use the emulator and then just burn a 27C EPROM when you're done.

 

The MH6311 is a bit of a surprise, I didn't find any timers, there must be some but they can't be free-running timers like in the other chips. Looking at the code there may be another port, it would have to be on the port expander, its got 100-pins so there is plenty of space.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

That looks like fantastic work.

You must have quite a bit of experience to be able to figure out how to go about setting up a rig like that, Do you do much of that type of work for a day job ?

Also how come you use eprom and not eeprom chips ?



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

In order to view the code execution you have to have the processor running in external mode, the TCU that I am using has an EPROM stock. I am using an Intronix Logicport LA, you need 24 channels for address and data plus a few spares for logging pin changes or serial port data. Its been very reliably, I used it an awful lot for 10 years or so.
I made a crude adapter from veroboard as a temporary solution (also about 10 years ago!) - individual probes are too time consuming to set up.

I also have a Moates Ostrich 2 emulator again, which I have used lot for 27C256 emulation, it should work with the 512 so I need to get that running so I can do real time code changes which will speed things up considerably.

The DSM TCU:

 MD759132 PCB

A screen capture of the Logicport software and the test software listing:

Logicport software



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

So let me get this right.

If a pin is set to read as an input you can actually access the data on the internal upper and lower buses?

Does this hold true for all ic’s ?

what kind of logic analyser are you using, as I seen then on eBay for as little as 50 quid?

 

TechSupport wrote:

Its usually on the sticker on the front, the non-flash OTP devices can still be read, if the flash version supports mode 0 then it will be possible to read it n the same way.
I have a logic analyser on the bus, for input pins the code just reads the ports and copies them to RAM locations, on a read the data is exposed on the bus, then I just inject a signal onto the pin to cause it to change state; for output pins I just toggle the output and then look for the pin.
I will look for the higher order ports next, the code is different to that on the MH6211 so they may not be in the same locations.


 



__________________
Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

I would not expect you to be out of pocket mate. 
I have an evo 4 one here that I don’t care about that I’ll send you if that’s the road you want to go down, or if you have already bought the evo 5 ecu then just sent me your PayPal or the like and I’ll reimburse you in full.
Things to be aware of is that only very early evo 5 had the metal case ecu it then changed to the plastic case ecu which was the h8 based processor.
That link to the colt ecu looks identical to an evo4/early evo5 ecu, as they were all maf based cars.
Thanks for your work so far it is greatly appreciated.

 

TechSupport wrote:


I found an EVO5 ECU that should have the MH6371 processor and it was cheap so I don't mind if I accidently wreck it. It should be identical to this one: 

https://forum.carlabimmo.com/viewtopic.php?t=14895

 


 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I found an EVO5 ECU that should have the MH6371 processor and it was cheap so I don't mind if I accidently wreck it. It should be identical to this one: 

https://forum.carlabimmo.com/viewtopic.php?t=14895

 



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I've been looking at how the registers are initialised and used, some are already known and tested, there are some differences between this device and the other devices. I don't have a code tag so I'll put it in a quote:

;;------------------- Registers -------------------------------------
; In all other devices user RAM starts at 40h
; thise looks the same - 40 is not directly initialised;
P1DDR equ 0x00
P2DDR equ 0x01
PORT1 equ 0x02
PORT2 equ 0x03
P3DDR equ 0x04
P4DDR equ 0x05
PORT3 equ 0x06
PORT4 equ 0x07
;
; 8 to E are TMR1 in all other devices
L0008 equ 0x08  ; T1CSR1
L0009 equ 0x09  ; TMR1H
L000A equ 0x0A  ; TMR1L
L000B equ 0x0B  ; T1OCR1H
L000C equ 0x0C  ; OCR1L
L000D equ 0x0D  ; ICR1H
L000E equ 0x0E  ; ICR1L
;
; F is P3 CSR in all other devices
L000F equ 0x0F
;
SCIRMC equ 0x10
SCSR equ 0x11
RXD  equ 0x12
TXD  equ 0x13
; 14 is RAMCR in all other disassembled
;
L0014
;
P5DDR equ 0x15
PORT5 equ 0x16
;
; MH6211 18 to 1E is timer1/2
L0017    ; initialised to 0x0E
L0018    ; initialised to 0x0E
L0019    ; 8-bit, initialised to 0x0E
L001A    ; 8-bit, initialised to 0x0E
;
; 1F,20,21 are connected - from line C2D0,
; in MH6211 1F and 20 are PORT6 and
; 20,21 are unused in EE88 code
;
L001F    ; 8-bit, initialised to 0x00 or 0x01 - bitfield
L0020    ; only bit5 is read
L0021    ; 8-bit write, 8/16-bit read
;
L0023    ; timer for SCI?
L0024    ; 8-bit, written to 3F in SCI code
;
; 26,27 are both read at start of interrupt vector 2
L0026    ; 8-bit, r/w could be RTI CR
L0027
;    ; 8-bit, r/w could be RTI
; 29,30 is TMR2 in MH6211
L0028    ; init as double #$2800
L0029    ; 8-bit written twice to 00h
L002A    ; 8-bit written twice to 00h (not in same place as L0029)
L002B    ; 8-bit written 00 or 1F
L002C    ; 8-bit written to 00 or FF
;
; possible DDR init P6DDR, P7DDR?
L002D    ; 16-bit written once in DDR routine as #$C123
; possible port init PORT6, PORT7?
L002F    ; init as double in Port routine - 8-bit bitfield
L0030    ; 8-bit bitfield
;
L0031    ; 8-bit bitfield init as 01
L0032    ; init as 00, no further r/w
L0033    ; init as 11, no further r/w
L0034    ; written as 16-bit 8001 or 0001, written as 8-bit from maths
;
ADCCR1 equ 0x38
ADCCR2 equ 0x39
ADCRES equ 0x3D
;
L003E    ; init as 22, no further r/w

so the easy things to look for next are the two possible ports at 2F and 30 and also to look at the possible timer locations, looking for continually incrementing values.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Its usually on the sticker on the front, the non-flash OTP devices can still be read, if the flash version supports mode 0 then it will be possible to read it n the same way.
I have a logic analyser on the bus, for input pins the code just reads the ports and copies them to RAM locations, on a read the data is exposed on the bus, then I just inject a signal onto the pin to cause it to change state; for output pins I just toggle the output and then look for the pin.
I will look for the higher order ports next, the code is different to that on the MH6211 so they may not be in the same locations.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

wow that is great to see progress being made .

i am amazed that you can essentially write some code to make the ports identify themselves.

In regards to the number on the case are you taking about the sticker on the side or the case part number on the front.

If the chip is one time programmable is it still possible to dump the contents of the chip without killing it?

 

on another note I’ve been doing a little ecu work myself tracking down the cam and crank subs on a h8 based ecu and dissembling I’ve attached a picture of the setup using an arduino to feed cam and crank sensors. (Keeping busy when off work in the current state of affairs.)

 



Attachments
__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I've determined most of the Port5 pins now.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I've sniffed out eight analogue channels now, I wrote some code to scan through the ADC channels and send the channel number and result out through the serial port; the code needs to be a little different to the smaller chips, this appears to be because there are an extra couple of channels. Selecting the upper two channels needs a further code mod which I will try at another time.
I now have the watchdog reset pin on the processor set to an input and I'm injecting a signal from an external signal generator to keep the MA7815 happy. The earlier E528A just needed kicking before the watchdog timed out, the MA7815 is a windowed watchdog and has to be kicked between 20ms and 535us. Its a reasonable window but until I got it working properly I didn't know how long an ADC read would take. It was also very difficult to debug while it was continually resetting.



-- Edited by TechSupport on Wednesday 15th of April 2020 06:07:44 PM

__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

There just isn't a datasheet, the 6301 covers the basic, unextended instruction set, modes and architecture. that was why I started creating a datasheet from my old notes. I've found a few issues with it but I'm updating it as I go now.
What numbers do you have on the cases? usually Mitsubishi mark the labels with an M, T or E for Masked ROM, One Time Programmable or EPROM. On the picture of your ECU I can see that you have a T marked on the connector, which would usually indicate OTP.

__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

Ah I see so as long as a main chip has code to look at external memory address it can be manipulated.

What ic do you think may be closest to the 76c55 that has an available datasheet?


TechSupport wrote:

Test mode on the 68HC11 is quite different. On the 68/63/76 series mode0 runs in extended mode but allows access to internal memory, The reset vectors are fetched from the external memory during power on reset, that allows you to jump to your own code, memory reads are no different to normal programme execution.


 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Test mode on the 68HC11 is quite different. On the 68/63/76 series mode0 runs in extended mode but allows access to internal memory, The reset vectors are fetched from the external memory during power on reset, that allows you to jump to your own code, memory reads are no different to normal programme execution.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

I’ve been searching for a toshiba 100 pin micro controller with pin outs similar to the 76c55 to try find a describition of the eeprom read function but to no avail.

i did however come across the manual for the m68hc11 and have a question on it.

The m68hc manual talks about the special test mode that you describe but also says that if the security bit is set that it will erase the entire rom and ram before a read out, my question is how do you avoid this when your dumping the entire memory?



__________________
Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

3 of them have the part number MD336610

The Ralliart ecu has a slightly different part number RA336610C1



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

What part numbers are your ECUs?

__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

The ”enable flash read” is a guess based on 4 ecus With the same board running the same engine.

Only one of the 4 ecus Which was mapped by Ralliart has components connecting chip pin 38 to the 4 plug header pin 79.

That pin 79 on the 4 plug header is used on the Next generation h8 based board and the later again sh board To enable flash Flash read.



-- Edited by Bob on Tuesday 31st of March 2020 07:37:26 PM

__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

You have a pin labelled 'Enable Flash read' - where did you get that information from? If the chip numbering follows standard Toshiba practice then your chip should be an EEPROM device so there should be a way to read/write it directly. It may be that for this chip mode0  is not supported.

I don't believe that there is any way to modify the contents of the E310A, I have some notes on it somewhere but from memory it just buffers the CAS/crank signals and also outputs an inverted version.

I'm updating the datasheet as I go because I'm using it as a reference, along with other code, there is some data that didn't get added to it before.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

The rx/tx pin as I have labeled goes to X2. 74hc165 chips that then goes out too pin 7 on the obd2 plug, I think they are also toggled by a transistor to pin 1 on the obd1 plug.

ill attach the 74hc165 chip pdf that I found.

out of interest does the e310a have changeable code to allow for the use of different cam and crank signals?


TechSupport wrote:

Is that pin-out for the 76C55? the RX/TX pin looks to be in the wrong place but it may be a switch for OBD1/OBD2. Analogue inputs look right, on my board those lines go through some custom chips, I'll put a resistor box on the inputs and see what arrives at the processor.
E310A is primarily a level translator between 12V and 5V for digital inputs, it also does some signal conditioning for cam/crank.



-- Edited by TechSupport on Monday 30th of March 2020 07:23:13 PM


 



Attachments
__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Is that pin-out for the 76C55? the RX/TX pin looks to be in the wrong place but it may be a switch for OBD1/OBD2. Analogue inputs look right, on my board those lines go through some custom chips, I'll put a resistor box on the inputs and see what arrives at the processor.
E310A is primarily a level translator between 12V and 5V for digital inputs, it also does some signal conditioning for cam/crank.



-- Edited by TechSupport on Monday 30th of March 2020 07:23:13 PM

__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

I’ve attached a picture of the pins that I have traced out .

The picture I used is correct in it’s numbering and orientation but the labels are not correct so you will see that I’m re-labelling  as I test the pins.

The enable flash read pin is of interest as it is not connected on one of the factory ecus that I have (components not fitted to board), it is however connected on the Ralliart ecu which would have been mapped by them instead of Mitsubishi direct.

That particular pin allows the h8 chip and the sh chip be read on later ecus.

if needed I’ll trace out the output sides of this chip.

Theres is a couple of sensors like maf/cam/crank etc feed into a secondary chip labeled e310a which I’m guessing is like and analog to digital converter.

which pin is port 1 ?



-- Edited by Bob on Monday 30th of March 2020 04:22:06 PM

Attachments
__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Bob wrote:
Is there anything I can be doing to help?

 


 If you could trace out a couple of the analogue inputs and find out what pins they are connected to that would be useful, I don't have a pinout for the TCU that I have.

 

I have made a little more progress, I have located the pins for PORT1, tomorrow I will try and find PORT2. My emulator is not working correctly so progress is slow because I have to erase and burn an EPROM each time I need to modify the code.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

Yes it is ma7815

ive attached 2 pictures.



Attachments
__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Bob wrote:
What kind of code do you run on an unknown chip? 

Its not entirely unknown, its from the same family as the smaller chips and it was determined years back that they used a superset of the 6301 instruction set. I have compared the code with that from an earlier processor and can I see some similarities (and differences) in the architecture. At the moment the plan is to copy the existing configuration settings and then toggle each of the outputs in turn and see what pin changes. I'm also trying to send data out of the serial port.

 

The hybrid on your board, is that also a 7815?



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

Thats good news that progress has been made.
What kind of code do you run on an unknown chip? 
I had a look over the EA528A circuit you posted and that is above my level of understanding at the moment as I’ve never encountered a need to understand a chip like that, but I’m guessing by understanding how that circuit works will allow you to get around it.
Is there anything I can be doing to help?

TechSupport wrote:

I've been able to run some code on the board but, as I suspected, the watchdog timer is causing issues. The watchdog timer is part of a hybrid circuit MA7815which looks to be very similar in operation to the EA528A fitted to many Suzuki ECUs. I've just published the timing diagram for that on this thread: https://rhinopower.activeboard.com/t30468381/33920-70e10-vitara-16-8v-tbi-1999/

I will instrument the TCU tomorrow and try to sniff out the port pin that resets the watchdog.


 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I've been able to run some code on the board but, as I suspected, the watchdog timer is causing issues. The watchdog timer is part of a hybrid circuit MA7815which looks to be very similar in operation to the EA528A fitted to many Suzuki ECUs. I've just published the timing diagram for that on this thread: 

https://rhinopower.activeboard.com/t30468381/33920-70e10-vitara-16-8v-tbi-1999/

I will instrument the TCU tomorrow and try to sniff out the port pin that resets the watchdog.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

yeah hopefully it is possible to pull the on board rom as I’m looking forward to having a look at the maps on board my 24 year old Ralliart ecu.



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

The RAM is internal, EPROM is external. This particular ECU has a 27C512 EPROM so the complete 64k address space can be utilised, once we get inside the chip we will see how much ROM it has.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

So is the 12k rom and the 1463 bytes of ram what the mh6311 has on board ,or what it has access to on the eprom?

 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I located the EPROM chip and I've performed a crude disassembly. First impressions are that it has a, relatively, huge interrupt vector table - 46 entries. I think I've located the serial port interrupt vector and code so I have  a port that I can use to stream out the internal ROM. The processor has an 'E' number so it will have some code in it. First I will load the stock configuration and then some code to send a square wave to each of the outputs in turn to sniff out the port pins.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

The safety chip performs similar functions, on the older engine ECUs it can often generate the limp signals to drive the injectors and ignition. I may need to cut a track or lift a component, I should be able to find the reset line in the code and just toggle it to keep the ECU 'alive'

I found the original EPROM, the code uses 12k of EPROM and 1463 bytes of RAM, the E clock runs at 4MHz. By comparison the 76C175/MH6211 has 4k of ROM, 447 bytes of RAM and runs at 2MHz.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

Very interesting 

out of interest does that safety chip on that gearbox control unit perform the same function as the “limp home” chip in an engine ecu as you have described in one of the articles on tuning the stock ecus?

when you disable the watchdog are you simply cutting a trace or removing a chip?

That 80 pin chip on the bottom of the board would interest me at a later date as I believe it to be the same used on later ecus to process maf/crank/cam etc signals before be sent to the main h8 or sh processor .

 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I don't have any 74HC165 chips on my ECU, I would think that is some sort of peripheral interface so the data lines would go to it and there would be an address decoder for it. What I am working with is this:

 

DSM TCU MH6311 76C55

 

The small square chip with the blue resonator is the 'safety' chip, I will need to disable the watchdog; the bottom chip is a port expander with some address decoding; the empty slot is for the EPROM. I'm sorting out the missing firmware at the moment, when I get that I will copy the configuration from it and then run some custom code on the ECU - hopefully it has a serial port I can utilise.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 

 

Are the data lines the ones going to the dual shift register 74hc165 chips ?
I had a quick look at the data sheet page and did not see the updated pinouts but I may have missed them .

Im excited to see weather or not this chip can be read.

 

TechSupport wrote:

I've no data at all for the MD759132 and no EPROM. I've traced out the data and address lines and I was able to figure out the 12V power pins and run it up. I've updated the datasheet page and if I find some time tomorrow I will write some code for it and see what happens. If it uses the same die as the 84-pin chips then the pinout should be similar, relatively.


 



__________________
Bob


Veteran Member

Status: Offline
Posts: 53
Date:
Permalink  
 


Firstly I’d like so say thanks for taking an interest in this and for helping out.
To answer you’re question,yes I have access to a friends evo 3 ecu with external eprom that is using ostrich 2.0 .
Also in regards to the fto transmission ecu I can get one of them too but that will be next weekend.
I also have an arduino that I can set up to do a serial read and probably get it to pull the mode pins to 0v for what ever time is required.
As for powering up my ecu I have it on a bench at the moment and have various sensors hooked up and can read the values through the obd2 port and a program call evoscan.

 

TechSupport wrote:

The memory size is 4k on the 84-pin chips so it sits at C000h in the memory map, you may have more or less memory. To read the memory you need to load a program into an external memory device that will then be run in Mode 0 and will read the internal memory out through the serial port so you need to find that as well, you may have some test points on those traces. I use a 27C256 as the external memory and place the ROM reader programme lower down on the memory map to avoid bus contentions with internal memory.

I tend to just dump the entire memory map, it will copy the RAM and the reader programme but that can be edited out. The code usually starts at the bottom of the memory so that's easy to find. The Stack Pointer is set to the end of RAM, that location will be found in the first few bytes of RAM. You only have a 16-bit address bus so the memory range is 64k max.

Do you have access to an ECU with an external EPROM? if not then you won't easily be able to determine the pins for the data and address lines, it is possible but its extra work.

I originally had a Suzuki Vitara with a 70E10 ECU, this had an 84-pin chip with an external EPROM; that was the first of these processors that I reversed engineered. The mode pins will be near the crystal somewhere, I did have an ECU with the 100-pin chip years ago but I've no idea what happened to it. I'll have a look for it - it may just have been an odd one that came in for repair.

 

Edit: I found the ECU very quickly, its an MD759132 which Google says is a Mitsubishi FTO Gearbox ECU, the one I have has no EPROM fitted, I'll have a look for that too.



-- Edited by TechSupport on Sunday 15th of March 2020 12:02:01 PM


 



__________________


Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

I've no data at all for the MD759132 and no EPROM. I've traced out the data and address lines and I was able to figure out the 12V power pins and run it up. I've updated the datasheet page and if I find some time tomorrow I will write some code for it and see what happens. If it uses the same die as the 84-pin chips then the pinout should be similar, relatively.



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

The memory size is 4k on the 84-pin chips so it sits at C000h in the memory map, you may have more or less memory. To read the memory you need to load a program into an external memory device that will then be run in Mode 0 and will read the internal memory out through the serial port so you need to find that as well, you may have some test points on those traces. I use a 27C256 as the external memory and place the ROM reader programme lower down on the memory map to avoid bus contentions with internal memory.

I tend to just dump the entire memory map, it will copy the RAM and the reader programme but that can be edited out. The code usually starts at the bottom of the memory so that's easy to find. The Stack Pointer is set to the end of RAM, that location will be found in the first few bytes of RAM. You only have a 16-bit address bus so the memory range is 64k max.

Do you have access to an ECU with an external EPROM? if not then you won't easily be able to determine the pins for the data and address lines, it is possible but its extra work.

I originally had a Suzuki Vitara with a 70E10 ECU, this had an 84-pin chip with an external EPROM; that was the first of these processors that I reversed engineered. The mode pins will be near the crystal somewhere, I did have an ECU with the 100-pin chip years ago but I've no idea what happened to it. I'll have a look for it - it may just have been an odd one that came in for repair.

 

Edit: I found the ECU very quickly, its an MD759132 which Google says is a Mitsubishi FTO Gearbox ECU, the one I have has no EPROM fitted, I'll have a look for that too.



-- Edited by TechSupport on Sunday 15th of March 2020 12:02:01 PM



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.



Guru

Status: Offline
Posts: 1291
Date:
Permalink  
 

Continuing from here: https://rhinopower.activeboard.com/forum.spark?aBID=133095&topicID=30481695&p=3

 



__________________

1984 Suzuki SJ413K pick up, 1.6 16V Baleno engine
2000 Suzuki Vitara 1.6 8V, many mods
2004 Suzuki Ignis 1.5VVT 4Grip
2006 Suzuki Jimny 1.3VVT JLX+
and many more.

«First  <  1 2 | Page of 2  sorted by
 
Quick Reply

Please log in to post quick replies.



Create your own FREE Forum
Report Abuse
Powered by ActiveBoard