Page 2 of 10 FirstFirst 12345678910 LastLast
Results 21 to 40 of 190

Thread: Funny adventures in electrical engineering

  1. #21
    Join Date
    May 2004
    Location
    Tokyo/Burnaby
    Posts
    1,369
    .... so what are we doing ?

  2. #22
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Thanks for the quick photo BCAE92, looks like what i expected: a daughter card with the d151802 (toshiba 8x processor), a cpld for address/data demuxing and port emulation, and either an eeprom or flash memory with the tuned code on it. sometimes code on these aftermarket modules is encrypted, but the encryption is pretty weak: they toy around with the data lines (d0 on the eeprom could go to d5 on the micro) and then program swapped data into the eeprom, so a simple smash and grab of the data wont disassemble and protects their secrets, but honestly it's not hard to crack given a few constant features that any program would have. - this has been addressed previously with techtoms i think.

    Quote Originally Posted by thatoreoguy View Post
    .... so what are we doing ?
    currently: getting toyota's engine management code from a CDM (talk to trigger happy, i think it's CDM) bluetop PCM and hacking it to bits. short term goals are to be able to identify maps and make adjustments. In order to make changes I will need to make custom electronics similar to the ones seen in the 3s-gte photos there.

  3. #23
    Join Date
    Apr 2009
    Location
    Worst Case Ontario
    Posts
    1,691
    Quote Originally Posted by thatoreoguy View Post
    .... so what are we doing ?
    Making a bluetop ecu sing, dance, and play trombone

    If you need a visual aid, here you go :P, at about 0:30 in the video (Also Sparkie, I think the term is USDM, but yeah they are the PCM's we got here in Canada)

    I hate Corollas but I don't think I can do better with anything else

  4. #24
    Join Date
    Aug 2004
    Location
    86tuning, Vancouver
    Posts
    8,869
    Want higher rev limit. Will overclocking the ECM accomplish this?
    - Brian


  5. #25
    Join Date
    Oct 2005
    Location
    Richmond, B.C.
    Posts
    5,225
    Not understanding any of this, yet was compelled to read it all

  6. #26
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Quote Originally Posted by Brian View Post
    Want higher rev limit. Will overclocking the ECM accomplish this?
    indeed it will, however it does that by making the measured rpm (inside the cpu) slower than the actual RPM. if you picture a typical table based setup you could see how this could push you out of the actual cell you're operating in and into a lower cell, which is likely to have suboptimal tuning parameters for the operating point. compounding this error is the fact that load is likely derived from MAF and RPM (roughly, from basic physics, load=MAF/RPM), so a lower measured RPM leads to a higher calculated load, which (i guess) would throw more fuel at it and subtract a little timing...

    ...which sounds like it would work well enough. looks like we're going to have to order a bunch of 4.1MHz crystals now

    really i hope to be able to find the constant that measured RPM is compared to and set it to some value exceeding 9000RPM.
    *waits for "over 9000" jokes to be resurrected*

  7. #27
    Join Date
    Mar 2013
    Location
    Vancouver, BC
    Posts
    1,185
    I liked the part about the Trombonist. I could understand it. It was neat.
    '80 MX32 sedan |'83 AE71 wagon |'84 AE86 hatch
    '85 AE86 coupe |'86 AE86 hatch |'86 AE86 coupe
    '88 MR2 S/C |'86 S12 hatch |'88 Silvia K's
    '91 Z30 Soarer '92 JZS147 Aristo |'92 S13 coupe
    '93 R33 Skyline |'98 S14 kouki


    Quote Originally Posted by JungleMatic View Post
    Is dyno like 200 for the hp if mustang shifts but 300 if corolla shifts?

  8. #28
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    as with later PCMs, the bluetop apparently has a RAM snooper routine built into the code. While the CPU isnt using the serial bus for useful things we can ask it kindly to give us two sequential bytes of data from the lower 256 bytes of memory (Config registers and RAM), so once I figure out what all the ram is being used for we could easily augment the PCM with a snooper tool which would log all the parameters (think sensor status and calculated values like timing and fuel) to a laptop.

    sound useful to anyone?

    and for the eggheads who actually downloaded the disassembly, the serial interrupt is at $F3DB and the snooper is inside that at $F404

    further updates: the chip so casually refers to direct addresses between $1f and $80 so much that I've begun to believe that a special variant of the HD6301 was made with more than 128 bytes of RAM, more like 224 bytes of RAM ($20 to $FF inclusive) and there's the occasional write to a reserved area in the register space ($15 - $1f inclusive) so thre could be hidden hardware suprises there.

  9. #29
    Join Date
    Mar 2004
    Location
    Koriyama, Japan
    Posts
    3,219
    Quote Originally Posted by Sparkie View Post
    indeed it will, however it does that by making the measured rpm (inside the cpu) slower than the actual RPM. if you picture a typical table based setup you could see how this could push you out of the actual cell you're operating in and into a lower cell, which is likely to have suboptimal tuning parameters for the operating point. compounding this error is the fact that load is likely derived from MAF and RPM (roughly, from basic physics, load=MAF/RPM), so a lower measured RPM leads to a higher calculated load, which (i guess) would throw more fuel at it and subtract a little timing...

    ...which sounds like it would work well enough. looks like we're going to have to order a bunch of 4.1MHz crystals now

    really i hope to be able to find the constant that measured RPM is compared to and set it to some value exceeding 9000RPM.
    *waits for "over 9000" jokes to be resurrected*
    There was a guy in the States that did this. I don't remember why, but he wanted to run a smallport off of a 4A-FE ECU. It worked well enough, I suppose, but I don't think he was able to do much with the fuel maps.

  10. #30
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    So there's interest in vancouver in overclocking the bluetop ecu to get a higher redline. I've offered one freebee (except shipping) in that direction for testing, and I'll do one freebee in the GTA for testing (cause it's easy and vancouver is sooo far away). So if you have a bluetop in your ride and you want more revs (mr e im looking at you) and you wont hold me responsible if it doesnt work or makes your engine poop its pants, we can work together on this one.

    side effects may include: more fuel/less fuel (yeah, it's a toss up), reduced timing advance, reduced dwell (less intense spark), complete failure of all analog sensors (no start!) and rectal herpes.

  11. #31
    Join Date
    Jun 2008
    Location
    Calgary AB
    Posts
    1,322
    Quote Originally Posted by Sparkie View Post
    Super happy update: I have successfully read out the code from the micro, and disassembled it, and sure enough it looks like real code. Took 2 minutes and 48 seconds at 244 bits per second (I went slow to make sure there weren't any errors)

    So here's the files! I suppose since this is starting to become technical and relevant I should close this thread and start a new one in the right section, or just get this one moved.
    cap.bin - the binary
    cap.asm - The disassembly of said binary.

    now I don't expect everyone to make use of these, but they're here.. I also need better file hosting.
    This is cool! I'd use github it's amazing, run it with the "google ext" and it syncs with a folder that you can put anywhere! Also if you code in a group everyone can push to the repository. I am also a comp sci'er

    side note almost everyone in GTA already has rectal herpes. aka centre of the universe syndrome
    Last edited by LastLatvian; 10-19-2013 at 01:49 PM.

    Quote Originally Posted by woodenturn View Post
    DK should ban such nonsense. 2 cents~ sr86 www.dorikaze.net/showthread.php?32933-Elizabeth

  12. #32
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Quote Originally Posted by LastLatvian View Post
    side note almost everyone in GTA already has rectal herpes. aka centre of the universe syndrome
    Shots fired!!! bahahaa. good one though.

    RE: OVERCLOCKING.
    I thought this one over a bit more over coffee with my wife (bless her heart) and I came to the realization that fuel will be REDUCED. a 10% overclocking should get you 10% more redline (forgive my dumbness, but what is fuel cut on the bluetop? 7600?) but will guarantee 10% shorter injection pulsewidths. I would only recommend this "upgrade" if you have a way of increasing fuel to compensate, which on the bluetop is limited to either a coolant temp sensor hack or AFM-monkeying or probably the most effective for this case: fuel pressure increase.

    For a 10% increase in injector flow you (according to something I read about a decade ago) you would need a (1.1)^2 = 1.21x = 21% higher fuel pressure. The GOOD news is that if the PCM is limiting injector duty cycle (which is common in fuel injection systems) then the duty cycle of the injectors decreases with increasing PCM clock, as the duration between injections gets longer from the PCMs point of view.

    a note about load calculation: It looks like IC201, branded ND (NipponDenso) SE056 is a mixed signal chip which calculates load for the CPU. It is the sole arbiter of the NE and VS signals, and while I once said that (roughly) LOAD=AFM/RPM, that equation can be re-arranged to avoid division (which was hard in the 80's!) in favour of an integral (stupid easy in the 80's!):
    LOAD=integral(AFM) over the interval between two sparks
    In fact, this method is superior in my opinion as you directly measure the quantity of air ingested by the cylinder (within bandwidth limitations) whereas the straight division gives you only an instantaneous snapshot (actually a derivative that can be scaled into load)

    and I'm thinking GITHUB is a good idea. I'll look into that soon

  13. #33
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    extra crap! i figured you guys probably aren't following along at home with your PCMs cut to ribbons and your oscilloscopes keeping your coffees warm, so here's a pic of the bluetop PCM in its naked glory:


    And here's a link to an even bigger picture.

    and here's a lazy schematic i've worked out to give myself a conceptualization of how everything goes together. note that when a label goes off to an external signal it actually almost NEVER attaches directly to that signal, but has some passives between the IC and the PCM connectors. right now I'm simply trying to isolate what code does what, not split atoms.

  14. #34
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Also coming hard and fast with the BOOOM, I give you GIT:

    https://github.com/sparkiedk/Toyota-PCM-hacking

  15. #35
    Join Date
    Jun 2008
    Location
    Calgary AB
    Posts
    1,322
    Quote Originally Posted by Sparkie View Post
    Also coming hard and fast with the BOOOM, I give you GIT:

    https://github.com/sparkiedk/Toyota-PCM-hacking
    YEAH! this is the best thread on DK so far, I am following along! I've been digging out all my old tools!


    Quote Originally Posted by woodenturn View Post
    DK should ban such nonsense. 2 cents~ sr86 www.dorikaze.net/showthread.php?32933-Elizabeth

  16. #36
    Join Date
    May 2006
    Location
    Campbell River
    Posts
    3,156
    Reading it all, understanding little (except the overclocking, that's simple enough a concept).

    I liked the part about the Trombonist. I could understand it. It was neat.
    I'm about there ^. But this is cool.
    1JZ 1984 Celica GTS
    1UZ 1981 Corolla sedan
    ? 1972 Celica race car

  17. #37
    Join Date
    Feb 2011
    Location
    Kumamoto Japan
    Posts
    2,515
    I am also understanding next to none, but I am very interested!

  18. #38
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Quote Originally Posted by LastLatvian View Post
    YEAH! this is the best thread on DK so far, I am following along! I've been digging out all my old tools!

    Now that scope really looks like it will keep a coffee warm! What time bases can it do? I've got a dual trace full digital model that is almost as old as I am (after my buddy blew up my 20MHz dual trace analog one) which does 250MS/s. in fact, here's a picture of the science lab

  19. #39
    Join Date
    Mar 2004
    Location
    Koriyama, Japan
    Posts
    3,219
    Once the code is dumped and interpreted, is there any way we can get it running on an ARM M4F based system?

  20. #40
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,468
    Quote Originally Posted by 4Aaron GE View Post
    Once the code is dumped and interpreted, is there any way we can get it running on an ARM M4F based system?
    yes, but it will take forever. your big problems will be porting the assembler from motorola style to arm style, fixing all the bugs that arise from clever use of register and memory overflows (this processor is 8 bit, except for reg's X, S and occasionally D), and emulating the hardware. then once you're done emulating the hardware you'll realize how crippled this micro was and you'll become tempted to start using additional hardware on the ARM M4F, then in effect you'll be developing your own ecu by plagiarizing a design from the 80's - which is basically how rap songs are made.

    I've already begun designing a fuel and spark computer using a vanilla arm7 as my chip... i was able to do bilinear floating point interpolation in 3d tables with boundry checks (100% safe) in 30 microseconds, which is a hair over 1 degree of crank rotation @ 6500 rpm. I suppose the point of this diatribe is that given your hardware choice, you're beter off reading a combustion engine theory book and writing the whole thing from scratch. with arm cortex power you'ld be able to create a virtual space of ALL your engine measurable parameters and create a SINGLE n-d table to spit out fuel values, and still have memory left over to play dwarf fortress.

    I'd recommend you nab the datasheet for the HD6301v1 from the git repository just to get a better feel for what im blabbing about.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •