Tweet
worth reading, very basic understanding of the 68HC11
the dictionary
the dissasembler i use
register addresses
a commented color coded TGP chip dissasembly. I did not comment this.
When looking at the dissasembly, addresses:
$00-$ff is battery backed SRAM
$100-$1ff is non battery backed SRAM, all P4 ECM's have this
$1800-$1fff is the extra 2k SRAM found on the DOHC ECM's
$8000-$ffd5 is the EEPROM area, 8000 to 9800 or a000 are the data tables, depending on the mask determines when the assembly starts. its a000 on the TGP $8f mask and 9800 on $df
The way the ECM inputs and outputs stuff is through serial slaved IO chips, IE there is a seperate chip that controls reading and converting a sensor and all the ECM has to do is poll that chip (it is mapped to a hex address in the $4000 range).
The way the ECM works is so. There are 16 major loops and 2 minor loops. There is an external timer that triggers an interupt 16 times a second, this interupt calls a procedure that looks up address in a table. These 16 addresses are the 16 major loops, they handle sensor data and various other functions. The 2 minor loops are switched off between, odd major loops one runs, even major loops the other runs. These 2 minor loops are fuel and spark, so both of those are calculated 8 times a second. Example: major1 minor1 | major2 minor2 | major3 minor1 | major4 minor2 | etc
the dictionary
the dissasembler i use
register addresses
a commented color coded TGP chip dissasembly. I did not comment this.
When looking at the dissasembly, addresses:
$00-$ff is battery backed SRAM
$100-$1ff is non battery backed SRAM, all P4 ECM's have this
$1800-$1fff is the extra 2k SRAM found on the DOHC ECM's
$8000-$ffd5 is the EEPROM area, 8000 to 9800 or a000 are the data tables, depending on the mask determines when the assembly starts. its a000 on the TGP $8f mask and 9800 on $df
The way the ECM inputs and outputs stuff is through serial slaved IO chips, IE there is a seperate chip that controls reading and converting a sensor and all the ECM has to do is poll that chip (it is mapped to a hex address in the $4000 range).
The way the ECM works is so. There are 16 major loops and 2 minor loops. There is an external timer that triggers an interupt 16 times a second, this interupt calls a procedure that looks up address in a table. These 16 addresses are the 16 major loops, they handle sensor data and various other functions. The 2 minor loops are switched off between, odd major loops one runs, even major loops the other runs. These 2 minor loops are fuel and spark, so both of those are calculated 8 times a second. Example: major1 minor1 | major2 minor2 | major3 minor1 | major4 minor2 | etc
Comment