Need help on decoding a program for a Propeller project....
jknightandkarr
Posts: 234
Does anyone here know the Motorola 68HC11 programming language? I'm trying to decode a project so I can start a propeller based version of it. The project is actually the Chevy TBI ecm for my 89 305 TBI Trans-Am and I need to create a working Propeller version of the ecm before I can go farther and where I want with my project. I have the ecm program itself as well as the calibration file, but I'm having trouble trying to learn the language at all, so I can learn what all math the ecm does with the Cal. Data to control the engine.
Joe
Joe
Comments
The best way to start is to get a manual for processor (68HC11). Figure out where start of program is and create a flow chart of program. One approach could be to write a "disassembler" that would take the object code from 68HC11 and create the program and data flow.
Any questions from this vague, let me know. I've done a few of these in the long past , they can be a challenge.
Rick Murray
Took a quick google, manual is not a problem. Also you need to trace every i/o pin to determine what's being read/controlled (and what kind of electrical interface is needed). Such as FI drivers, cam and crank timing, etc. If any A/D involved, then external circuits for prop are needed.
Looking a 68HC11 specs, shows 8K of ROM, is there another ROM chip in ECU (seems small, Denso ECUs are 256K to 384K)?
It looks like 8 A/D channels, external chip likely required for prop. I/O count seems good.
Prop speed and 32 bit data will be a plus (68HC11 is 8 bit and much lower clock speed)
What budget do you have?
Rick Murray, PE
RGM Engineering
http://www.retro.co.za/disasm11.html
Seems to need DOS, but you can get FREEDOS to boot from a CD. Maybe a LInux version as well.
And go here for more support.
http://www.faqs.org/faqs/microcontroller-faq/68hc11/
I can do the tracing, but some of the circuits I have no clue what the IC chip's are. It could take awhile. I figured the Prop could run like 50 to like 33 times faster then the GM unit. The 68hc11 seams to run either 2 or 3 Mhz, so the prop with its 8 cores can get data, perform calcs & outputs much faster then gm unit, though i figured I'd use multiple props n network em togeather.
Thanks for the links, I'll have to check em later, time for work.
Joe
A data flow chart is a pictorial version of how the code works; Let's say you find the starting location of program (ei Hex 100), first instruction is to jump to another location, you then go to that location and determine what that instruction is doing; ie a test of a pin status, then the program goes one way if pin is high and another way if pin is low. The program may reference a memory location and use the number(s) for a math function (ie; FI duration=preset mixture and throttle position and rpm). Not a simple job. You need to understand the code AND the function of the box. If the original code was written is assembly (unlikely in today's world), reading it won't be too bad. Normally the code is created with a compiler; C, etc. and can be very weird.
Joe
But this is a seriously serious job.
And you are in over your head, you know?
Print out the disassembled files and tape them to the wall.
Get your box of multi-color highlighters and go at it.
Search the machine readable file to locate references and mark them on the paper.
Identify all I/O pins. There are some options depending on the model. So this could be a trip.
Also the pins themselves can be in or out depending on how they are initialized.
Some of the external circuitry can be identified by how the software interacts with it.
That might tell you something useful.
Identify important memory references.
See which memory locations are related to what I/O pin usage.
Tables are often accessed by index (offset) reference.
Check the use of the X and Y registers (16 bit).
On-Chip ram is from 0000 to 00FF (256 bytes)
Special registers from 1000 to 103F
ROM or EEPROM options depending on the specific model of the ship.
Identify that first.
If it has 2K EEPROM that will be located F800 to FFFF
Otherwise probably just 512 bytes of EEPROM from B600 to B6FF
FFC0 to FFFF are reserved for interupt vectors.
Rice University -
https://www.clear.rice.edu/elec201/Book/6811_asm.html
For example one project wast to make a C version of some control code written in 8080 assembler. Even starting from the original source code this took myself and another guy, working full time ,over a year to get working!
That was a simple case. When you have to figure out what is going on with on chip timers, external logic, interrupts etc etc and don't have the original source code things get exponentially more difficult. And it get's increasing harder to know if your recreation actually does what the original did correctly.
I would not dream of taking on a job like this as a hobby project unless I was at least twice as nerdy as I am and had nothing else to do for a year or so.