 |
 |
From post: Doc Teaches ECU School
A while ago, Doc and I had a conversation on IM that turned into a very informative post.
It is now archived here for your reading pleasure:
Author: blundar Date: 05-28-03 19:55
Today, I spent some time in ECU school learning about OBD1 ECUs. You should read this. Ive cleaned it up and edited a little, but for the most part is just a conversation. Thanks to Doc for being willing to help the rest of us catch up.
Note: all code snippets and memory addresses refer to P30_203 (JDM P30 stock)
doc: ya, what do you want to know?
blundar: inputs: are they more or less direct to IO pins or is there an IO controller in the middle?
doc: the IO controller (82 C55) has 2 output ports, and 1 input port (if i remember right), and near the eprom is a other 20pin IC (can't remember it's number) which is a 8bit input, too ... and some direct IO on the CPU, like for VSS, injector test circuit, and some others. of course, the analog inputs are direct on the CPU but the analog are multiplexed - 2 ic's left of the CPU
blundar: you remember which ICs?
doc: don't have it in mind, need to check there numbers
blundar: are the TTL inputs like the ones for a clutch switch multiplexed?
doc: if i remember right, the input for the clutch switch (AT PN we used) is connected to the 20 pin (Latch or similar part) near the eprom
blundar: could you point to me in the code (or give me an example) of how to tell if the switch is on or off?
doc: sniplet out of the P30 stock: as example the A/C control routine - here you see the A/C switch, and as output the A/C clutch:
4306- DA 11 17 : JBR off 11.2, 4320 ; A/C switch @ bit 11.2
4309- C4 26 1C : SB off 26.4
430C- F4 E2 : LB A, off E2
430E- CE 1B : JNE 432B
4310- C4 E3 98 32 : MOVB off E3, #32
4314- C4 1B 18 : SB off 1B.0
4317- 95 : RC
4318- CB 15 : SJ 432F
431A- C4 B8 15 : CLRB off B8
431D- C4 E3 15 : CLRB off E3
4320- C4 26 0C : RB off 26.4
4323- F4 E3 : LB A, off E3
4325- CE ED : JNE 4314
4327- C4 E2 98 32 : MOVB off E2, #32
432B- C4 1B 08 : RB off 1B.0
432E- 85 : SC
432F- C5 20 38 : MB 20.0, C ; A/C Clutch?! @ bit 20.0
doc: so: "off 11.2" is a digital input and 20.0 is a output on the 82C55
blundar: So the ECU buffers inputs... how many are there for on/off TTL inputs?
doc: i found off 10h and off 11h for the inputs in the 203 code but this can vary from ecu code to ecu code!
blundar: how did you figure it out?
doc: i checked almost every input by applying a signal on the input and measure with the scope where the signal goes - in the code: hours of reading :-)
blundar: are all the outputs driven off the 89C55?
doc: i'm not 100% sure, i'm sure some are direct driven by the MCU (PWM outputs), and the injectors are dirven by a "injector controller", maybe the ignition output signal is controlled by this controller, too. need to check this in deep
blundar: vtec, auto trans lockup, AC, ?
doc: all these signals are driven by the 82 C55
blundar: how does the 66K communicate with the 89C55?
blundar: MB 20.0, C
blundar: that looks to me like the 89C55 is mapped into the memory space... (I'm a 66K ASM idiot tho)
doc: a bit weird! yes, in the code on the addresses 20, 22, 24 ... but, then these memory locations are copied to 0f00, 1f00, 2f00 (which is now really the 82C55
ya, there is no real address decoder in the obd1 ecu, so they did it with a little trick, but now it uses this addresses :-( )
blundar: ahh I c
blundar: so those memory addresses 20h 22h 24h are like a buffer?
doc: right
blundar: can I take my guesswork a little bit further? 20.0 = AC out, 20.1 = another out, 20.2 = another out :)
doc: yes
doc: 22.0 is vtec solenoid
blundar: is 22.1 the auto tranny lockup solenoid?
doc: don't know - i don't spend any time on the automatic parts, cause i don't have a auto ecu - i can find it out on a manual, too, but will be more work to trace back the wires from the transistors back to the 82c55
blundar: do you understand the pattern between pins on the 82c55 and memory locations?
doc: no, cause i never worry about it. btw: we don't have a datasheet (pinout) of the 82c55 cause it a unusual 44pin type (as opposed to the normal 40 pin type)
doc: i guess, the feedback signals are connected to the 82c55
blundar: hmm
doc: i.e. it looks like that the VTS (feedback) is on address 10.5
doc: VTS check routine:
3D06- DC 16 1B : JBR off 16.4, 3D24 ; Jmp if VTEC disabled
3D09- EC 14 18 : JBS off 14.4, 3D24 ; jmp if VTS error
3D0C- DA 1F 0C : JBR off 1F.2, 3D1B ; jmp if Vtec not active
3D0F- C4 C0 98 14 : MOVB off C0, #14
3D13- F4 BF : LB A, off BF
3D15- ED 10 0C : JBS off 10.5, 3D24
3D18- 85 : SC
3D19- CB 09 : SJ 3D24
3D1B- C4 BF 98 14 : MOVB off BF, #14
3D1F- F4 C0 : LB A, off C0
3D21- ED 10 F4 : JBS off 10.5, 3D18
3D24- C5 9A 38 : MB 9A.0, C ; Error #21 VTS ???
blundar: VTS check routine: if you were to remove / disable that you wouldn't throw a code when the vtec solenoid was unplugged right?
doc: right
blundar: do the configuration jumpers (RP17, RP18, etc) correspond with inputs that are multiplexed in?
doc: RP17, RP18 are on the multiplexed ANALOG inputs !
blundar: OMG
doc: :-) ya, it's fun
Theyre mostly for configuration, and some engine bay singals
blundar: hmm
blundar: so in summary, the ECU buffers inputs and outputs 20h, 22h and 24h are output bytes, and 10h + 11h are input bytes, with individual bits of each byte corresponding to on/off
doc: right
doc: also, 14h is a error byte
|
Copyright © 2002-present by the contributing authors. All material on this collaboration platform is the property of the
contributing authors, and is covered by the Non-Commercial Share-Alike License unless explicitly stated otherwise. |
|