1990 Legacy 4EAT TCU romid:705263

[b3lha]

Andrey in Moscow sent me some rom dumps to look at. I'm starting with this one because I already have a suitable disassembler program. This is a dump from the 4EAT Transmission Control Unit of his 1990 Legacy. This TCU has a 68HC11 CPU and it looks similar to the one that Ryan on USMB has been working with.

The attached zip file contains a binary dump (tcu-705263.bin), a hex dump (tcu-705263.hex) and a disassembly of the program code (tcu-705263.asm). I plan to look for the parameter addresses by comparing this program to my SVX program for which the addresses are known. The SVX code is a newer and more complex version, but there a lot of similarities.

[b3lha]

Here is the error code table. The first part is for current errors, the second part for stored errors.

Code:

e596 DATA 01 40 11 01 20 12 01 80
e59e DATA 13 01 08 14 01 01 15 05
e5a6 DATA 02 21 05 08 22 05 04 23
e5ae DATA 01 10 24 05 01 31 01 02
e5b6 DATA 32 01 04 33 8e 04 34 8c
e5be DATA 10 35 8d 40 41 8e 02 42
e5c6 DATA 8c 40 43 8c 20 44 8d 20
e5ce DATA 45 8d 01 51 8d 04 52 8d
e5d6 DATA 08 53 8d 10 54 8d 02 55

e5de DATA 03 40 11 03 20 12 03 80
e5e6 DATA 13 03 08 14 03 01 15 04
e5ee DATA 02 21 04 08 22 04 04 23
e5f6 DATA 03 10 24 04 01 31 03 02
e5fe DATA 32 03 04 33

Split it into columns of three:
01 40 11
01 20 12
01 80 13
etc.
This means get the value from address 0x0001 perform a binary AND operation with 0x40. If the result = 1 then set error code 11 (duty solenoid A). In other words, the sol A error flag is bit 6 of address 0001.

Here it is decoded. The address, followed by the meaning of each of its eight bits. For example, if address 0001 had the binary value 01000100 it would mean error codes 11 and 33. Duty Solenoid A and Vehicle Speed Sensor 2. Error codes 34 to 55 are undocumented.

Code:

0001:  13 (sol3), 11 (solA), 12(SolB), 24(SolC), 14(Sol2), 33(VSS2), 32(VSS1), 15(Sol1)
0005:  x, x, x, x, 22(Aps), 23(Rpm), 21(Temp), 31(TPS)
008c:  x,43,44,35,x,x,x,x
008d:  x,41,45,54,53,52,55,51
008e:  x,x,x,x,x,34,42,x

0003:  13 (sol3), 11 (solA), 12(SolB), 24(SolC), 14(Sol2), 33(VSS2), 32(VSS1), 15(Sol1)
0004:  x, x, x, x, 22(Atm), 23(Rpm), 21(Temp), 31(TPS)

The next step is to find where these error flags get set in the program. Then examine the nearby code to find the parameter addresses.