??? 01/10/07 22:56 Read: times |
#130606 - Other issues Responding to: ???'s previous message |
I disassembled a similar (it could be the same) box - I think it came out of a Hyundai Excel '95. It has a '537 cpu. There was also a couple of custom ics that the code seems to do a lot of work with. It seemed to read, process the write specific blocks of data. It is definitely a Bosch design, but made under license by a Korean company.
Here's the first bit of it.... WDTREL equ 086h PCON equ 087h DPSEL equ 092h IEN0 equ 0a8h IEN1 equ 0b8h IEN2 equ 09Ah ; ; UART1 ; S1CON equ 09bh S1BUF equ 09ch S1REL equ 09dh IP0 equ 0a9h IRCON equ 0c0h CCEN equ 0c1h CCL1 equ 0c2h CCH1 equ 0c3h CCL2 equ 0c4h CCH2 equ 0c5h CCL3 equ 0c6h CCH3 equ 0c7h CCL4 equ 0ceh CCH4 equ 0cfh CC4EN equ 0c9h CRCL equ 0cah CRCH equ 0cbh TL2 equ 0cch TH2 equ 0cdh ; ; a/d converter ; ADCON0 equ 0d8h ADDAT equ 0d9h DAPR equ 0dah ADCON1 equ 0dch ; ; capture/compare ; CTCON equ 0e1h CML0 equ 0d2h CMH0 equ 0d3h CML1 equ 0d4h CMH1 equ 0d5h CML2 equ 0d6h CMH2 equ 0d7h CML3 equ 0e2h CMH3 equ 0e3h CML4 equ 0e4h CMH4 equ 0e5h CML5 equ 0e6h CMH5 equ 0e7h CML6 equ 0f2h ;not used CMH6 equ 0f3h ;not used CML7 equ 0f4h ;not used CMH7 equ 0f5h ;not used CMEN equ 0f6h CMSEL equ 0f7h P4 equ 0e8h P5 equ 0f8h ; ; arithmetic unit ; MD0 equ 0e9h MD1 equ 0eah MD2 equ 0ebh MD3 equ 0ech MD4 equ 0edh MD5 equ 0eeh ARCON equ 0efh INJ_DISABLE equ 02bh ;has bits to disable individual injectors org 2eh ds 8 ;temp area for sensor calcs?? org 38h ds 1 ;coolant temp org 78h ds 1 ;injector1 ds 1 ;injector2 ds 1 ;injector3 ds 1 ;injector4 org 09ah ds 1 ;air flow * 0.625 ds 1 ;air flow * 0.625 /8 org 0a6h ds 1 ;air flow sample count ds 3 ;air flow accumulator (24bit) hi,mid,low ds 2 ;air flow value hi,low ;------------------------------------------------------------------------------- ; ; Xram locations (we're not too sure what's i/o and what's ram ) ; ; ;------------------------------------------------------------------------------- org 0xf830 ds 6 ;->0x2e org 0xf84b ds 5 ;->0x2f org 0xf8ca ds 5 ;->0x2e coolant temp sesnor org 0xf8cf ds 5 ;->0x2e air temperature sensor ;------------------------------------------------------------------------------- ; ; ; disassembly of the bosch ecu for the hyundai excel 95 ; air flow ; sequential injection ; wasted spark (dual coil) 4 cylinder ; uses siemens 80c537cpu methinks ; ; ; Port 1 ; P1.0 cc0,int#3 capture enabled ; P1.1 cc1,int#4 ; P1.2 100hz pwm? cc2 ; P1.3 100hz pwm? cc3 ; P1.4 cam angle input int#2/cc4 ; P1.5 check engine lamp ; P1.6 injector 5?? ; P1.7 injector 6?? ; ; Port 3 ; P3.0 SPI data in ; P3.1 SPI clock ; P3.2 extint0 ; P3.3 speed sensor input int1 ; P3.4 ; P3.5 ; P3.6 WR ; P3.7 RD ; ; Port 4 ; P4.0 injector 1 ; P4.1 injector 2 ; P4.2 injector 3 ; P4.3 injector 4 ; P4.4 output?? ; P4.5 cm5 output? ; P4.6 idle speed motor ; P4.7 idle speed motor ; ; P5.0 ccm0.. ; P5.1 ; P5.2 ; P5.3 ; P5.4 ; P5.5 ; P5.6 ; P5.7 diagnotic request input 0=request ; ; ; ; Port 7 A/D ; P7.0 throttle position ; P7.1 battery volts ~70mV/count 18v=5v. 12v=3.3v (scale 3.6) ; P7.2 ; P7.3 coolant temp ; P7.4 air flow input ; P7.5 ; P7.6 ; P7.7 oxy sensor (input voltage times 2 methinks) ; ; PORT 8 A/D ; P8.0 air temp ; P8.1 terminal 40?? ; P8.2 ; P8.3 ; ;------------------------------------------------------------------------------- ; reset 0000 02 00 9E LJMP 009EH ; exint0 0003 02 20 00 LJMP 2000H 0006 02 02 02 0009 02 02 ; timer0 o/f 000B 02 20 08 LJMP 2008H 000E 02 000F 02 02 02 0012 02 02 ; exint1 0013 02 20 2B LJMP 202BH 0017 02 02 0019 02 02 ; timer1 o/f 001B 02 20 3B LJMP 203BH 001E 02 001F 02 02 02 0022 02 ; serial0 0023 02 20 4B LJMP 204BH 0026 02 02 02 0029 02 02 ; timer2 002B 02 20 53 LJMP 2053H 002E 02 002F 02 02 02 0032 02 02 02 0035 02 02 02 0038 02 02 02 003B 02 02 02 003E 02 02 02 0041 02 02 ; a/d converter 0043 02 20 5B LJMP 205BH 0046 02 0047 02 02 02 004A 02 ; exint2 004B 02 20 63 LJMP 2063H 004E 02 02 0050 02 02 02 ; extint3 0053 02 20 6B LJMP 206BH 0056 02 02 02 0059 02 02 ; extint4 005B 02 20 7B LJMP 207BH 005E 02 005F 02 02 02 0062 02 ; extint5 0063 02 20 83 LJMP 2083H 0066 02 02 02 0069 02 02 ; extint6 006B 02 20 93 LJMP 2093H 006E 02 006F 02 02 02 0072 02 02 02 0075 02 02 02 0078 02 02 02 007B 02 02 02 007E 02 02 02 0081 02 02 ; serial1 0083 02 20 9B LJMP 209BH 0087 02 02 02 008A 02 02 02 008D 02 02 02 0090 02 02 02 0093 02 02 02 0096 02 02 02 0099 02 02 ; compare timer o/f 009B 02 20 A3 LJMP 20A3H ;RETI ;------------------------------------------------------------------------------- ; ; things start here ; ;------------------------------------------------------------------------------- 009E E5 A9 MOV A,IP0 00A0 A2 E6 MOV C,ACC.6 ;get WDTS 00A2 92 D5 MOV PSW.5,C 00A4 D2 BE SETB IP.6 ;wdt 00A6 02 20 AB LJMP 20ABH Good luck with the disassembly - its hard work, but worth it. You will learn many things. |
Topic | Author | Date |
Siemens Processor Identity? | 01/01/70 00:00 | |
a couple of hints | 01/01/70 00:00 | |
Thanks | 01/01/70 00:00 | |
try Keil | 01/01/70 00:00 | |
10 seconds of googling... | 01/01/70 00:00 | |
Thanks again. | 01/01/70 00:00 | |
google.com | 01/01/70 00:00 | |
Other issues | 01/01/70 00:00 | |
EG | 01/01/70 00:00 | |
Thanks again! | 01/01/70 00:00 | |
Megajolt? | 01/01/70 00:00 | |
Thanks! | 01/01/70 00:00 | |
Bounce | 01/01/70 00:00 | |
Should work | 01/01/70 00:00 | |
Plans![]() | 01/01/70 00:00 |