1997 F-Body ECM

[kur4o]

Great find, that $800 bytes part is missing on 94-95 code. It must be the instruction set or code for the tpu. Italso is placed on a non shared memory region with eside. I guess on 94-95 version it is hard built. Later it is configurable.

Now I found some differences that might help you.
16FC is loaded with 004C vs 0044. than a pause is executed. It might be processor reset or mode change for reset the shared memory.

16F0 is not set vs loaded with #0003 before the microstore is loaded and than cleared after that.
It might be set bit that unlocks eside access to TPU non shared memory region.

Than the microstore is loaded. We will have to find where in the TPU ram that is stored to get the processor`s correct offset.
That looks like instructions code, or the main core that the TPU runs from. Make a byte repeat analysis to find the opcodes. If we can find the correct offset and the instruction set a disassembly can be made.


Thatis the other main change the size and address is the same but data slightly differs.

                                      fdb $84                 ; a6b4-a704 cal data 1600-??? for tpu
RESERVED:A6B6                 fdb $CD
RESERVED:A6B8                 fdb $279
RESERVED:A6BA                 fdb $379
RESERVED:A6BC                 fdb $479
RESERVED:A6BE                 fdb $579
RESERVED:A6C0                 fdb $679
RESERVED:A6C2                 fdb $779
RESERVED:A6C4                 fdb $879
RESERVED:A6C6                 fdb $9C1
RESERVED:A6C8                 fdb $AC1
RESERVED:A6CA                 fdb $B5
RESERVED:A6CC                 fdb $77
RESERVED:A6CE                 fdb $7B
RESERVED:A6D0                 fdb $A2
RESERVED:A6D2                 fdb $A6
RESERVED:A6D4                 fdb $1A
RESERVED:A6D6                 fdb $11A
RESERVED:A6D8                 fdb $21A
RESERVED:A6DA                 fdb $31A
RESERVED:A6DC                 fdb $41A
RESERVED:A6DE                 fdb $51A
RESERVED:A6E0                 fdb $61A
RESERVED:A6E2                 fdb $71A
RESERVED:A6E4                 fdb $8C8
RESERVED:A6E6                 fdb $9C8
RESERVED:A6E8                 fdb $AC8
RESERVED:A6EA                 fdb $BC8
RESERVED:A6EC                 fdb $C93
RESERVED:A6EE                 fdb $D93
RESERVED:A6F0                 fdb 0
RESERVED:A6F2                 fdb 0
RESERVED:A6F4                 fdb $F38
RESERVED:A6F6                 fdb $E91
RESERVED:A6F8                 fdb $BB
RESERVED:A6FA                 fdb 0
RESERVED:A6FC                 fdb $EA9
RESERVED:A6FE                 fdb 0
RESERVED:A700                 fdb 0
RESERVED:A702                 fdb 0

vs

RESERVED:7AFC                 fdb $8E                 ; table
RESERVED:7AFC                                         ; 7AFC-7B4B
RESERVED:7AFC                                         ; INITIAL VALUES LOADED FOR 1600-1650 at reset
RESERVED:7AFE                 fdb $CC
RESERVED:7B00                 fdb $2DE
RESERVED:7B02                 fdb $3DE
RESERVED:7B04                 fdb $4DE
RESERVED:7B06                 fdb $5DE
RESERVED:7B08                 fdb $6DE
RESERVED:7B0A                 fdb $7DE
RESERVED:7B0C                 fdb $A7
RESERVED:7B0E                 fdb $8F
RESERVED:7B10                 fdb $D0
RESERVED:7B12                 fdb $D7
RESERVED:7B14                 fdb $D8
RESERVED:7B16                 fdb $76
RESERVED:7B18                 fdb $AF
RESERVED:7B1A                 fdb $DD
RESERVED:7B1C                 fdb $33
RESERVED:7B1E                 fdb $133
RESERVED:7B20                 fdb $233
RESERVED:7B22                 fdb $333
RESERVED:7B24                 fdb $433
RESERVED:7B26                 fdb $533
RESERVED:7B28                 fdb $633
RESERVED:7B2A                 fdb $733
RESERVED:7B2C                 fdb $8C6
RESERVED:7B2E                 fdb $9C6
RESERVED:7B30                 fdb $AC6
RESERVED:7B32                 fdb $BC6
RESERVED:7B34                 fdb $CC6
RESERVED:7B36                 fdb $DC6
RESERVED:7B38                 fdb 0
RESERVED:7B3A                 fdb 0
RESERVED:7B3C                 fdb $FE4
RESERVED:7B3E                 fdb $C1
RESERVED:7B40                 fdb $6E
RESERVED:7B42                 fdb $C4
RESERVED:7B44                 fdb $E92
RESERVED:7B46                 fdb $E85
RESERVED:7B48                 fdb $AA
RESERVED:7B4A                 fdb $5C

I will try to find a bin for the diesel PCM and see how TPU is set there.

[Tom H]

$800 bytes part is missing on 94-95 code. It must be the instruction set or code for the tpu. Italso is placed on a non shared memory region with eside. I guess on 94-95 version it is hard built. Later it is configurable.

OK, that may be a great help. The TPU in the '302 that dzidaV8 wrote about has a ROM and the ability to add custom routines in RAM as an extension. It may be that the 2K of code I am looking at adds extensions to the ROM. Things like multiply, divide and so on, may be routines in the ROM/Library that are called. If true, this would add yet another dimension to the problem. I will see if the ROM can be dumped... it will take me a while though.

All sorts of guesses on my side but: Given that the TPU exists in a chip select window $1400 : $17FF: Given that the 2K RAM extension exists between $1400 and $14FF: None of this constrains the addressing internal to the TPU. In theory the address space of the TPU could be 524288 bytes wide (that's 64K X 64bit word)!. I think it likely however that the ROM would exist down low between $0000 and $13FF. Time will tell

-Tom

[kur4o]

I have another theory. The chip has built in rom with $800 bytes and some bootloader. At reset the $800 bytes are copied to ram and the loop is executed from there. Later eside can take control and rewrite the $800 bytes with user specified code. In 94-95 the code is what the pcm needs, so it is not updated. In 96-97 the code needs some changes and eside loads new custom code for the new features of the pcm.

The TPU might have different memory layout and the shared memory there can be seen at $0-$2df compared to eside 1400-16df.

I looked again at the data and it seems like 8byte instruction scheme. Each 8 bytes represent some instructions sequence and the second byte is likely 00 or randomly around 80 or 40.

It could be some form of calibration data.

[Tom H]

This post is a little off the current topic, but perhaps of use to some folks who have "bricked" a PCM. I am looking at the ESide with a view to placing the processor in bootstrap mode. There is a 40 pin connector that is not populated located opposite edge from the black connector. It's on both T & Eside boards. I believe this was used by the developers and the folks doing the calibrations. The connector attached to a 3rd board with a two port memory. There is still code set up to drive this test board that exists in the release code. An example of this came up when looking at the TPU... Location $3B85 is set in the calibration to a location in the TPU that the engineer wants to monitor. Production code sets it to zero, but when in use it would be set in the $1400 - $17FF range.

In any case, back to the bricked PCM problem... The un-stuffed connector has connection for TXD, RXD, Ground, ModeA, ModeB and +5V on that connector in the first 8 locations. I believe that was such that the test board could re-flash. We can use these signals in the same way to run test code. Our test code can easily re-flash the part to un-brick. I hope to get the bootstrap mode working today/tomorrow. When this gets done, I will publish some pictures with the pinout and an intro of how to run test code on the ESide board.

-Tom

[kur4o]

The un-stuffed connector has connection for TXD, RXD, Ground, ModeA, ModeB and +5V on that connector in the first 8 locations

That will be awesome if you can figure it out how to use it.
It is only been speculated how to implement the headers but never done. I traced most of the pins to the memory chip, but there might be more for the processor. Anyway to reflash the chip on board a 12v source will be needed for the VPP pin on the flash chip.


I managed to find a 2000 diesel bin, and made a quick disassembly. The TPU doesn`t have the extra data written as per 96-97 code. It is set up more like the 94-95 code. I will try some earlier diesel bins to find some data for comparison.

[Tom H]

Hi,

I was able to place the ESide in bootstrap mode, just a little more complicated than I thought. I had forgotten the bit about the bootstrap places port D in wire or mode. I needed a 10K pullup there. Second is that the RX is not defaulted in my case. This is because the ribbon between E & T sides has been removed. This required a second pullup OR to be driven by my usb<-->serial cable. Since I had no connection, this floated and started a download with no valid data = crash.

This download mode is the same as I used for my 68HC11 based Opti-simulator. Thus I have the needed software to include the initial 0xFF. Probably won't get to this for a few days to try things out. Wife has some complaints re time spent.

Details to follow...

-Tom

[dzidaV8]

I have another theory. The chip has built in rom with $800 bytes and some bootloader. At reset the $800 bytes are copied to ram and the loop is executed from there. Later eside can take control and rewrite the $800 bytes with user specified code. In 94-95 the code is what the pcm needs, so it is not updated. In 96-97 the code needs some changes and eside loads new custom code for the new features of the pcm.

The TPU might have different memory layout and the shared memory there can be seen at $0-$2df compared to eside 1400-16df.

I looked again at the data and it seems like 8byte instruction scheme. Each 8 bytes represent some instructions sequence and the second byte is likely 00 or randomly around 80 or 40.

It could be some form of calibration data.

I agree with you, and I think we shouldn't consider the TPU as a microprocessor, I'm pretty sure it's an FPGA matrix with a tiny bootloader, like in 68332 micros. The binary opcodes for 68332 TPU are really dense in data packing (i.e. only two MSb define the major operation, the rest are operands), so there might be no obvious repetition in 16 or 8 bits looking at the binary.

[dzidaV8]

Another interesting piece to read about the TPU in LS1 PCMs

[Tom H]

Hi,

I was able to place the ESide in bootstrap mode, just a little more complicated than I thought. I had forgotten the bit about the bootstrap places port D in wire or mode. I needed a 10K pullup there. Second is that the RX is not defaulted in my case. This is because the ribbon between E & T sides has been removed. This required a second pullup OR to be driven by my usb<-->serial cable. Since I had no connection, this floated and started a download with no valid data = crash.

This download mode is the same as I used for my 68HC11 based Opti-simulator. Thus I have the needed software to include the initial 0xFF. Probably won't get to this for a few days to try things out. Wife has some complaints re time spent.

Details to follow...

-Tom

I have run code on the ESide this morning, this is yet another tool in the box to unravel the TPU.

The code I ran is a simple "Hello World!" sort of thing. It just sits there kicking the 68HC11's COP and the PRU's watchdog while sending the message over and over. Plan is now to get a better look at the TPU. Suggestions re code to write are welcome.

* Clock source	12.5829 to the test boards 16MHZ
* Eclock	 3.1457 to the test boards 4MHZ
* Baud rate for ESide 1,887.4HZ

REGISTERS	EQU	$1000		;
RAMSTART	EQU	$0000		;
RAMEND		EQU	$03FF		;

SCSR		EQU	$2E		;
SCDR		EQU	$2F		;


	ORG	$0000			; SET ORIGIN

START	SEI				; MASK INTERRUPTS
	LDX	#REGISTERS		; POINT X AT REGISTER BASE ADDRESS

LOOP 	LDY	#HELLO			; POINT AT MESSAGE START

	LDAA	#$55			; RESET 68HC11 COP
	STAA	$103A			; COP ARMED
	LDAA	#$AA			; 
	STAA	$103A			; COP RESET

	LDD	#$50A0			; RESET THE PORT REPLACEMENT
	STAA	$1806			; WATCHDOG TIMER
	STAB	$1806			;

WAIT_TX	BRCLR	SCSR,X,#$80,*		; WAIT TO TX NEXT CHAR

	LDAA	0,Y			; READ MESSAGE BYTE
	STAA	SCDR,X			; TRANSMIT OVER SCI

	INY				; POINT TO NEXT CHAR
	CPY	#HEND			; TEST FOR LAST OF MESSAGE
	BEQ	LOOP			; BACK TO 1S WAIT

	BRA	WAIT_TX			; SEND NEXT CHAR

HELLO	DB	"Hello world!!!"
	DB	$0A
	DB	$0D

HEND	EQU	*

	END	START

Again, details to follow...

-Tom

[Tom H]

Thank you for the info dzidaV8!

Looks like I have a bunch of reading ahead.

-Tom

[Tom H]

Hi,

This is a quick note to describe how the 68HC11 bootstrap mode can be used to further learning details of the PCM. The second use would be to revive a bricked PCM.

To place the processor in bootstrap mode, drive both modea and mode pins low and power the board. After reset, TX should be driven to a break condition until you start the download. After the first character of your binary is sent, the tx will echo all the received bytes.

Assemble your program to run within the internal ram. Small, light, compact is the only way here. Prepend the binary with an FF character and send to the board using 1,888 baud. Once these steps are complete, the bootstrap loader will execute your program at $0.

The connections to the board are given in the attached picture. Please note that bootstrap mode uses wire or mode. This means that a pullup on the TX is needed OR that your program needs to change the setting. I added the resistor (10K) for simplicity and because the mode affects other pins on the port. I did not want contention with some other chip, and the resistor avoids this. For best practice, I also added a 10K pullup to the RX side. This just defaults the RX to prevent a "download" from starting before I connect the serial.

I am attaching a few files... I have a program that takes an Srecord file and turns it into a bin, complete with the leading "0xFF". Ask me if you want the source, but it isn't something I am proud of... sort of a hack job to "geterdone". Just a console app but it got carried away re-using some Srecord parsing code that already existed. Nuf said.

Second attach is an HC11 program to dump areas of memory in srecords. Please note that bootstrap enforces the EEPROM to exist at 0xFE00 - FFFF. So without re-program of the config reg, you can't see that bit. This is of no trouble to me, as the intent is to figure out the TPU.

Questions: please ask and I will help if I can BUT the major project for me needs to be the TPU. All info and code is offered at your risk and you need to understand the boot mode well before you proceed. I have not written code to erase and clear the FLASH as yet. I will do this later perhaps

I had trouble attaching the .exe and .asm files. I renamed them as .exe.txt and .asm.txt. I hope these will get through OK.

-Tom

[Tom H]

PS

Here is a sample of the output sent through the SCI serial.

S1132B1078780D0D0F151B2D3F78787878787878B4
S1132B20780D0D0F151B2D3F7878787878787878A4
S1132B3020202020201E0A0A0A0A0A0A0A0A0A0A6F
S1132B400A66666E6238211A110D0606050404042D
S1132B5004048A864D26190B08050505040404049B
S1132B60048A864D261905040303020203030404A0
S1132B705F69737D800702D002D00036003A02D02C
S1132B8002D0002C003002D002D0004A004E02D005
S1132B9002D0004000445C5C5C5C5C5C5C5C5C6639
S1132BA070727476787C8080808080808080808061
S1132BB080808080808080CD4C003C827F83817BBC
S1132BC07D7F81897A798181787A88099A01A890B0

[kur4o]

I still think that the TPU has 2k of ram. 1400-17FF is shared with eside all the time. Eside can access tpu ram from 1800-2000 by setting some byte on the tpu. The switch byte is 16f0 and is set with $0003.

There is also some special routine for eside to read the shared memory.

RESERVED:5BCA ldaa word_146A
RESERVED:5BCD ldd word_146A
RESERVED:5BD0 std word_21C

and on 94-95

RESERVED:426A sei
RESERVED:426B ldaa word_16D0
RESERVED:426E nop
RESERVED:426F ldd word_16D0
RESERVED:4272 cli

Any ideas why it takes some extra time to make the read.

I tried reading the shared memory region with mode2 commands but always a zero is read.

A small program than can exploit the 16f0 bit might give access to all tpu memory not just the specified range. I am sure a backdoor was left for debugging.

Try first reading the shared memory region and if successful try setting the 16f0 bit to access all of the memory the TPU sees.

Awesome work on the bootstrap mode. It is too bad I cannot be of any help there. You will be the only one capable of writing code for unbricking the PCM in bootstrap mode. I suppose it will work with any flash based hc11 PCM of that years. We might be able to read abs and sir modules with it.

[WASyL]

i'm not a programmer at Your level guys so not sure if this will help but AFAIR 68HC12 is enhanced 16-bit version of the 68HC11. HC12 is used in Megasquirt 2, so try asking here http://www.msextra.com/ or their messageboard and it will shorten up lots of Your hard work. Also first Megasquirt was run by 68HC08 so they should know alot of about HC famili.
Handyboard that is used for lego alo runs HC11, loader can by found here: https://sourceforge.net/projects/hbloader-uml/
other links regarding : https://web.archive.org/web/20060710...u-m68hc11.org/


best regards

[Tom H]

Thank you WASyL, I will take a look!

-Tom