Pin out research thread - proof that i'm working on it lol

[Fred]

Comments : http://www.diyefi.org/forum/viewtopic.php?f=9&t=511

Code: Select all

0x0000 - 0x00FF

Plugged :

00000000: 00 00 00 00 00 00 00 00   1f 00 01 80 d0 00 3f 07 
00000010: 00 00 00 04 00 00 fd fe   00 00 c4 10 c0 00 40 00 
00000020: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000030: fe 00 40 00 02 01 00 7c   00 80 f1 00 00 00 80 00 
00000040: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000070: 00 00 00 00 00 00 ff ff   00 00 00 00 00 00 00 00 
00000080: 0f 0f 00 20 05 00 00 00   80 00 00 00 00 00 ff ff 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000b0: 00 00 00 80 00 00 00 00   00 04 00 00 c0 00 00 00 
000000c0: 00 04 00 00 c0 00 00 00   00 0d 00 0c 10 00 00 ff 
000000d0: 00 04 00 00 c0 00 00 00   04 00 00 20 00 00 00 00 
000000e0: 00 00 00 80 00 00 00 00   00 00 00 00 00 00 00 00 
000000f0: 04 00 00 20 00 00 00 00   04 00 00 20 00 00 00 00 

Unplugged :

00000000: 00 00 00 00 00 00 00 00   9f 00 00 80 d0 00 3f 07 
00000010: 00 00 00 05 00 00 fd fe   00 00 c4 10 c0 00 40 00 
00000020: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000030: fe 00 ff 00 02 01 00 7c   00 80 f1 00 00 00 80 00 
00000040: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000070: 00 00 00 00 00 00 ff ff   00 00 00 00 00 00 00 00 
00000080: 0f 0f 00 20 05 00 00 00   80 00 00 00 00 00 ff ff 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000b0: 00 00 00 80 00 00 00 00   00 04 00 00 c0 00 00 00 
000000c0: 00 04 00 00 c0 00 00 00   00 0d 00 0c 10 00 00 ff 
000000d0: 00 04 00 00 c0 00 00 00   04 00 00 20 00 00 00 00 
000000e0: 00 00 00 80 00 00 00 00   00 00 00 00 00 00 00 00 
000000f0: 04 00 00 20 00 00 00 00   04 00 00 20 00 00 00 00 

0x08, 0x0A, 0x13, 0x32 are different plugged and unplugged.
0x08 is PORTE and the difference is that E7 is high unplugged and low plugged in.
0x0A is mmcctl0 which is strange, but i've repeated the experiment a number of times without seeing it high again.
0x13 is mmcctl1 which is also strange, but this is always 0x05 value without the cables plugged in. I'll have to investigate this! It *could* have something to do with the porta behaviour!!
0x32 is PORTK which is strange, this could be to do with the memory registers!

Bed! TBC

Code: Select all

0x0100 - 0x01FF

Plugged :

00000000: c9 be 00 00 c7 c0 00 ff   00 00 00 00 00 00 00 00 
00000010: c9 00 00 00 ff c0 00 00   00 00 00 00 00 ff ff ff 
00000020: 00 ff 00 00 00 00 01 f0   01 01 00 00 00 00 00 00 
00000030: 00 04 00 00 c0 00 00 00   00 04 00 00 c0 00 00 00 
00000040: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: 2e f1 6c 92 4c 2b b2 56   c2 75 c5 1e fe 00 c4 f6 
00000070: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000080: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: 8b a0 52 be d3 b9 2b 05   77 bc ba be cd 00 a8 94 
000000b0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000c0: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
000000d0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000e0: ef e3 71 ed cb b4 64 a6   03 2b e7 a8 68 00 a3 e3 
000000f0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 

Unplugged :

00000000: c9 be 00 00 c7 c0 00 ff   00 00 00 00 00 00 00 00 
00000010: c9 00 00 00 ff c0 00 00   00 00 00 00 00 ff ff ff 
00000020: 00 ff 00 00 00 00 01 f0   01 01 00 00 00 00 00 00 
00000030: 00 04 00 00 c0 00 00 00   00 04 00 00 c0 00 00 00 
00000040: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: 2e f1 6c b2 0c 2b b2 56   82 35 c5 1e fe 00 c4 d6 
00000070: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000080: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: 8b a0 57 fe d3 b3 2b 0d   77 bc ba bc cd 00 a9 14 
000000b0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000c0: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
000000d0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000e0: fc e3 71 ed 4b b4 64 a6   03 2b e7 aa e8 00 a3 73 
000000f0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 

No differences except the RAM based registers.

Code: Select all

0x0200 - 0x02FF

Plugged :

00000000: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000010: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000020: 84 8c ba e3 15 c5 cc a2   af 33 3a e9 b0 00 d5 c4 
00000030: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000040: 03 03 00 00 00 00 00 00   0f 0f 00 00 ff 01 00 00 
00000050: 0f 0f 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: ff ff 00 00 00 00 00 00   37 37 00 00 f7 00 00 00 
00000070: 00 ff 00 00 00 00 00 00   ff ff 00 00 00 00 00 00 
00000080: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: ec 85 8e 12 6b 7e 04 4f   1e 01 0e b2 20 00 e5 06 
000000b0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000c0: 07 07 00 20 05 00 00 00   80 00 00 00 00 00 00 ff 
000000d0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000e0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000f0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 

Unplugged :

00000000: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000010: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000020: 2c 8c f2 e3 15 c5 cc 92   af 33 3a e9 30 00 35 44 
00000030: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000040: 00 00 00 00 00 00 00 00   ff ff 00 00 ff 01 00 00 
00000050: 0f 0f 00 00 00 00 00 00   00 00 00 00 00 00 00 3f 
00000060: 00 00 00 00 00 00 00 80   f7 f7 00 00 f7 00 00 00 
00000070: 00 ff 00 00 00 00 00 00   ff ff 00 00 00 00 00 00 
00000080: 01 11 00 00 00 00 07 00   00 00 00 00 00 00 00 00 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: e4 95 8e 1a 4b 7e 04 4f   1e 11 86 b2 20 00 e5 07 
000000b0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000c0: 07 07 00 20 05 00 00 00   80 00 00 00 00 00 00 ff 
000000d0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000e0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000f0: 00 01 00 00 00 00 00 00   00 00 00 00 00 00 00 00 

0x48, 0x49, 0x60, 0x61, 0x67, 0x68, 0x69, 0xF1 are different.

0x00 0x10 0x20 0x30 are all CAN3 registers.
0x00 is CTL0, flag is "in initialisation mode"
0x01 is CTL1, flags are "listen mode" and "in initialisation mode"
0x06 is TFLG, flags are each of the three transmit buffers is emtpy
0x20 is the RX region and thus full of garbage by the looks (I believe it's a RAM implementation, so this is not surprising...)
0x30 is the TX region, not sure why it is zero, perhaps a more traditional physical representation or some init logic or something.
0x40 is PORTT as is 0x41 both show that I have pull ups on the RPM inputs ;-)
0x48 is PORTS as is 0x49 both show the lower four pins as ON
0x4C is the pull up/down register, all PORTS pins are in pulled state
0x4D is the pull direction register, all but the first pin S0 are in the pull up state, S0 is in pull down
0x50 is PORTM as is 0x51 both show the lower four pins as ON
0x60 is PORTH as is 0x61 both show all 8 pins as ON which reminds me that they are inverted and pulled up externally. I'll repeat with the CPU card unplugged from the rest of the stuff and see what differences there are.

Code: Select all

0x0300 - 0x03FF

Plugged and Unplugged :

00000000: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000010: 00 00 00 00 ff ff ff ff   ff ff ff ff ff ff ff ff 
00000020: ff ff ff ff 00 00 00 00   00 00 00 00 00 00 00 00 
00000030: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000040: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000050: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000060: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000070: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
00000080: 00 00 00 00 00 00 fe 00   00 00 00 00 00 00 00 00 
00000090: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000a0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000b0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000c0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000d0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000e0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 
000000f0: 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00 

On lines 0x00 0x10 0x20 (up to and including the 5th byte) is the PWM control block. The PWM period and duty registers are all 0xFF and all other PWM control registers are 0x00.
0n line 0x80 the sequence 0000fe00 is the XGVBR block

Code: Select all

0x0400 - 0x04FF
0x0500 - 0x05FF
0x0600 - 0x06FF
0x0700 - 0x07FF

ALL zeros!

[Fred]

#define PORTA DVUCP(0x0000)
#define PORTB DVUCP(0x0001)
#define DDRA DVUCP(0x0002)
#define DDRB DVUCP(0x0003)
/* #define PORTC DVUCP(0x0004) these pins are not bonded on the 112 pin package */
/* #define PORTD DVUCP(0x0005) these pins are not bonded on the 112 pin package */
#define DDRC DVUCP(0x0006) /* these pins are not bonded on the 112 pin package but need switching to output */
#define DDRD DVUCP(0x0007) /* these pins are not bonded on the 112 pin package but need switching to output */

So, all of the data pins are off and are set as inputs.

#define PORTE DVUCP(0x0008)
#define DDRE DVUCP(0x0009)
//0x000A MMCCTL0 DVUCP()
//0x000B MODE DVUCP()
#define PUCR DVUCP(0x000C) /* pull up enable when used as an input, 0 = no pull up, 1 = pull up on */
#define RDRIV DVUCP(0x000D) /* reduced drive register when used as output, 0 = full drive, 1 = reduced drive */
//0x000E EBICTL0 DVUCP() /*
//0x000F EBICTL1 DVUCP() /*

to be continued...

[Fred]

experiments to prove it

TBC

[Fred]

http://www.diyefi.org/forum/viewtopic.php?f=9&t=511

[Fred]

Actually, there is nothing stopping Jared and Dave from decoding that into meaningful information!

You will need the XDP512 spec doc
You may want the header file from the code (optional)

Post your stuff in the comments thread (Jared, first block if you want to help, Dave second block if you want to help).

This means you guys have something to do and I can keep on coding.

It will be good for you to get an understanding of what the device does too. I can extract more register contents if required, but the first 0x0300 are probably enough for our purposes right now.

You can now see why it's taking a while and I wasn't looking forward to it.

I'll work on the third block if I get stuck doing other stuff on the train.

Go for it! :-)

Fred.

[Fred]

Updated with all the rest of the registers :-)

[Fred]

Game plan :

• investigate registers with non zero contents
• investigate the unknown pins and enter into pin out doc
• investigate the known high pins and find out why
• investigate the known high pins and see if we can tame them with resistors during reset/load.
• investigate loading effects on high pins.
• find free pin for fuel pump use
• choose chip(s) to isolate AND select ign outputs
• choose chip(s) to select inputs

[Fred]

See the first post for some interesting initial analysis.

I've worked ONLY on this tonight! More to come as I figure everything out and form a game plan!

Fred.

[Fred]

Update :

I just built a cut down version of 0.0.1 (yes it was possible to cut it down lol) and ....

PORTA is constantly ON with no touching of IO regs at all.

I'm pretty sure now that it's in emulation mode or external chip mode or something. I bet if I pull up or down the right pins the flashing port A stuff will go away and we can get on with the hardware design! :-)

Just have to figure out which pins and crack out the soldering iron.

Fred.

[Fred]

Pin K7 looked like it needed a pull down on it as did E3, however I did that and there was no change.

I tried moda and modb in both positions and confirmed that modc is pulled up correctly. no change.

Although the pulldowns worked on k/e, even with a strong pull down the voltage was still not close enough to zero. Thus those pins with pull ups on them should be configured to be ON by default and switched off to cause a behaviour (such as staged injection).

Fred.