In looking at distributor inputs, I am now convinced the Timer Processor Unit (TPU) is involved. That needs to be figured out to have any hope of understanding the heart of the system. The injector timing and spark timing are complex. Also the transmission monitoring is complex. I needed a simple place to start figuring the part out.
In looking through the ESide code, I believe the VATS to be a simple function. From what I see, PCM Connector C1 (RED) pin 25 (BLUE wire) takes a toggle signal from the BCM. The ESide routine that monitors the toggle rate runs at 12.5mS intervals --> 80 times a second. The code tests a register in the TPU against the sample taken in the previous run 12.5mS earlier. In case where there is at least some transitions on the line, it tests the rate. Two thresholds for rate are set in the calibration:
-CALIBRATION: $05B0 1456
-CALIBRATION: $04A8 1192
These may be specific to year/make/model, the above is what I have. All this suggests the nominal frequency sent by the BCM is 50HZ with the right key resistor in place.
The result of all this is a couple of flags are set when the right frequency is sensed.
One is used on the ESide to handle things like dtcs: -DTC P1626: PASS KEY FUEL ENABLE CIRCUIT CLEAR FLAG
and cut off of fuel pump / injectors.
The other is sent to TSide through the SPI byte 3, bit2.
SPI ESide E_Xfr T_Xfr TSide
BYTE03 $005E $0098 $02F3 $00AE
BIT 0 DTC P0200: INJECTOR CIRCUIT CLEAR FLAG
BIT 1 DTC P0200: INJECTOR CIRCUIT SET FLAG
BIT 2 VATS FUEL ENABLE FLAG
BIT 3 DTC P1222: INJECTOR CONTROL CIRCUIT INTERMITTENT CLEAR FLAG
BIT 4 DTC P1222: INJECTOR CONTROL CIRCUIT INTERMITTENT SET FLAG
BIT 5
BIT 6
BIT 7 ESIDE MIL REQUEST FLAG
A Mode $23 command can be sent to read the VATS status. There are probably a bunch of other ways to do this, I only needed 1 to prove things out.
Using an ELM327 for access I sent "23 00 00 AE 01". This is with the header pre-set to "4C 10 F0"
The ECM responds with header: 4C F0 10 message:63 00 AE 04 00 00 00 crc: F8
The way I believe this part of the TCU works is:
CPU runs an oscillator at 12.5829mhz. The E clock is a divide by four 3.145725mhz. This is divided in the TPU by 48 resulting in a sample clock at 65,536hz. A nominal 50hz input will result in a count of 1310 or so. If I am correct in my assumptions, the threshold 1192 would give a top acceptable frequency of just under 55hz. Similarly, the threshold 1456 would give a bottom acceptable frequency of just over 45hz.
The tpu it's self operates similar to the 'hc11 input capture timers. One edge (perhaps the rising edge say) latches the count. The software subtracts the previous value and tests against the threshold.
=======================
Some questions for you all...
- Are all the functions of the TPU documented somewhere? If I knew all the things it does it would be a good help
- Are the connections to the TPU documented somewhere? Looking at the connected pins would help with the first Q
Speculation
- I think the 8bit read followed by a 16 bit read solved a problem of synchronizing between high and low bytes. The first read 8bit latches the value. The second read results in reading high first then low, like a normal 16 operation in an hc11. I expect address 0 is not even connected to the part. I plan to test for this.
=======================
VATS code segment
\
Code:
VATS code segment
4B6C B6 14 6A LDAA $146A ; READ TPU REGISTER
4B6F FC 14 6A LDD $146A ;
4B72 0E CLI ; ENABLE INTERRUPTS
4B73 37 PSHB ; STACK TRANSITION COUNT LS
4B74 36 PSHA ; STACK TRANSITION COUNT MS
4B75 B3 02 24 SUBD $0224 ; SUBTRACT PREVIOUS COUNT FROM CURRENT
4B78 38 PULX ; TRANSITIONS SINCE LAST TEST
4B79 27 15 BEQ $4B90 ; NO TRANSITIONS
4B7B FF 02 24 STX $0224 ; UPDATE PREVIOUS TRANSITION COUNT
4B7E 1A B3 20 23 CPD $2023 ; CALIBRATION: $05B0 1456 45HZ
4B82 22 0C BHI $4B90 ;
4B84 1A B3 20 25 CPD $2025 ; CALIBRATION: $04A8 1192 55HZ
4B88 25 06 BCS $4B90 ;
4B8A 14 01 80 BSET @$01,$80 ; VATS ENABLE FUEL FLAG
4B8D 14 5E 04 BSET @$5E,$04 ; SPI VATS ENABLE FUEL FLAG
Bookmarks