Motronic 1.1 question

[Buchholz, Steven]

Unless you can find someone who has BTDT before you, you may end up having
to reverse engineer the ECU a little to be able to figure the thing out.  I
realize that since you may not know exactly which microprocessor was used it
will be difficult, but what I did on the Hitachi-based unit in my car was to
track the top four bits of the address bus ... usually you'll find some sort
of de-mux ('138) in the circuit which does the decoding for the RAM/ROM/I-O.
Once you know where this is you can start to decode the addresses.  Knowing
where the processor starts reading from in the memory map can provide a clue
as well.  
 
If you are stuck, but can find some sort of a decoder on the board you may
be able to make headway by assuming that the designers of the circuit were
not deliberately trying to make them difficult to reverse engineer.  With
this assumption you could infer that the "7" decode output would go to the
highest memory map (0xE000-0xFFFF assuming a 16-bit address and a 3:8
decoder) counting down to the "0" output (mapping to 0x0000 to 0x1FFF in the
same example).  
 
If you are REALLY stuck, but can figure out the processor type and how it
operates you can get some clues by looking for vector tables to see what
locations they point to ... or disassembling code starting at what would be
address 0 to look for jump codes ... 
 
Good luck!
Steve Buchholz
San Jose, CA (USA)


 
Motronic 1.1 question. I have 2 ROMs. A single 2732 EPROM (4Kx8) and a ROM
(1Kx8). I still have to remove the one ROM from the ECU. Does anyone know
how to splice the code back together? Does the 4Kx8 code come first or is it
the 1Kx8? This will save me some time guessing. Thanks in advance.
 

----------------------------------------------------------------------------
To unsubscribe from diy_efi, send "unsubscribe diy_efi" (without the quotes)
in the body of a message (not the subject) to majordomo at lists.diy-efi.org