This file might be of use... Indicates accesses to the TPU. Missing could be accesses using indirection.
TPU_Access.pdf
-Tom
This file might be of use... Indicates accesses to the TPU. Missing could be accesses using indirection.
TPU_Access.pdf
-Tom
The later CPU32 Motorola chips might be helpful in figuring the LT1 TPU out. They have integrated TPU on a FPGA matrix that can also be custom microcode programmed.
Have a look at the documentation:
https://www.nxp.com/docs/en/applicat...te/TPUPN00.pdf
https://www.nxp.com/docs/en/reference-manual/TPURM.pdf
Hi,
dzidaV8, Thank you for your suggestions and links. The way I have been looking at the TPU has not been a success. I have written several pounds of code to look at the microstore in different ways. Even found fields within the code that address each of the two port ram locations I expect to be written by TPU. So far things have not fallen into place. Too much time spent for no result. kur4o had suggested that there might be a great number of versions with major differences... he is right.
What I have found though...
In the '97 version of tpu, address $16F4 is an interrupt status register on read and a clear interrupt on write. There are four active bits (mask $3C00) I have yet to identify the cause each bit represents. The service is quite easy to find though and I am still going through the code.
Also, The NXP documents you refer to suggest that the top 16 locations of the microstore are entry points. This looks like a match with the microcode in my flash. I say this because there is a large section of NOPs between what I think is code and the last 16 entries.
All the best for the new year to all! I will post from time to time when I come up with results.
Cheers,
-Tom
I think the tpu used is some form of 68hc11 processor with hardcoded rom. The data the main processor writes at reset is some form of configurations or options.
If the TPU is preset for different engines, you can change the presets for cylinder numbers, crank signal, ignition and injectors output and so on.
I suspect the code it runs is the built in timers in 68hc11
A real mess to decipher.Code:FSR:100E ; Timer Counter Register (High) FSR:100E ; mph PULSE FSR:100F TCNTL: fcb 0 ; Timer Counter Register (Low) FSR:1010 TIC1H: fcb 0 ; Input Capture 1 Register (High) FSR:1011 TIC1L: fcb 0 ; Input Capture 1 Register (Low) FSR:1012 TIC2H: fcb 0 ; Input Capture 2 Register (High) FSR:1013 TIC2L: fcb 0 ; Input Capture 2 Register (Low) FSR:1014 TIC3H: fcb 0 ; DATA XREF: IC3I+6r FSR:1014 ; Input Capture 3 Register (High) FSR:1014 ; cRANK PULSE SIGNAL FSR:1015 TIC3L: fcb 0 ; Input Capture 3 Register (Low) FSR:1016 TOC1H: fcb 0 ; Output Compare 1 Register (High) FSR:1017 TOC1L: fcb 0 ; Output Compare 1 Register (Low) FSR:1018 TOC2H: fcb 0 ; Output Compare 2 Register (High) FSR:1019 TOC2L: fcb 0 ; Output Compare 2 Register (Low) FSR:101A TOC3H: fcb 0 ; Output Compare 3 Register (High) FSR:101B TOC3L: fcb 0 ; Output Compare 3 Register (Low) FSR:101C TOC4H: fcb 0 ; Output Compare 4 Register (High) FSR:101D TOC4L: fcb 0 ; Output Compare 4 Register (Low) FSR:101E TCO5H: fcb 0 ; Output Compare 5 Register (High) FSR:101F TCO5L: fcb 0 ; Output Compare 5 Register (Low) FSR:1020 TCTL1: fcb 0 ; DATA XREF: sub_B9F2+A6r FSR:1020 ; sub_B9F2+ABw ... FSR:1020 ; Timer Control Register 1 FSR:1021 TCTL2: fcb 0 ; Timer Control Register 2 FSR:1022 TMSK1: fcb 0 ; DATA XREF: COMM_ROUT_sub_C75A+BF2w FSR:1022 ; __RESET-EFAw FSR:1022 ; Timer Interrupt Mask Register 1 FSR:1023 TFLG1: fcb 0 ; DATA XREF: IC3I+3w FSR:1023 ; Timer Interrupt Flag Register 1 FSR:1024 TMSK2: fcb 0 ; DATA XREF: COMM_ROUT_sub_C75A+BF5r FSR:1024 ; COMM_ROUT_sub_C75A+BFAw FSR:1024 ; Timer Interrupt Mask Register 2 FSR:1025 TFLG2: fcb 0 ; Timer Interrupt Flag Register 2 FSR:1026 PACTL: fcb 0 ; Pulse Accumulator Control Register FSR:1027 PACNT: fcb 0 ; DATA XREF: IC3I+9r IC3I+Cw FSR:1027 ; Pulse Accumulator Count Register
I found an analog for the philips knock chip, it is labelled
014
p57br
45153
It is used along with the philips chip on the same pcm.
Hi,
I am a bit of a skeptic re 'HC11 core. All the external registers, two port ram and so on are 16 bit. IF it is a standard micro core, I would expect an HC16 or??.
I still think the load sequence is set up for a 64 bit word & looks to me more like what a sequencer or dsp microcode would be. I will keep plugging on it for a while, but at some point will need to accept that there isn't enough info to figure the TPU out. This would be a sad end to a long project.
I still have a number of things to try, including loading test code into the Eside and working the timer that way.
-Tom
Another interesting read about TPU: http://www.eslave.net/tpu/pdf/TPUMASMREF_D3.pdf
I think it's quite possible that the chip used in LT1 PCM is what was later integrated in CPU32 and HC16 microprocessors. I highly doubt that there's a HC11 core in there.
D84G appears in another diesel PCM which also use optical sensor similar to the optispark. I am suspecting the chip is some kind of special motorola production made specifically to work with the opti signal. By the mask you can tell for sure it is motorola unit. It is very likely to have an internal rom, due to different mapping addresses being used. And can do more than just basic calculations.
Here is the thread that describes the diesel pcmhttps://pcmhacking.net/forums/viewtopic.php?f=8&t=4671
Some other techniques to try. Dumping the shared memory range can give some insights. In the above thread there is some UART reading with prog11.exe.
If we can suggest it is a HC11 core and have a UART pin you can give it a try.
Posting Permissions
Reply With Quote
Bookmarks