I will reply to this via EMail since I feel this is not directly related to the PinOut Document anymore and many readers might get annoyed (sorry folks)
Maybe we could move this to a thread about ECUs?
One last thought:
Maybe Nissan would be willing to help and reveal at least where/how the knocks are being computed?
After all the Z32ECU is >20 years old which is in the stone-age of electronics and I doubt Nissan would reveal any crucial secrets by telling.
AFAIK patents expire after 20 years anyhow ..
Nity nite,
Andrew
Matt wrote:Thats correct on the Hitachi ECUs there is a register which is read which has a bit set to '1' when knock is detected. This is then used to maintain knock counters. I added my own counter which is read via a new consult insturction and then reset. That way the application can read the counts at its leasure without timing critical reads required
I have found most of them on the Hitachi ECUs which are the ones which currently have knock support (except for Z32 which has still escaped me. Might be since its relate to the JECS ECUs and knock circuitry is done differently perhaps?)
I was able to test this by bypassing the knock sensing board and send a square wave signal directly into the chip which takes the signal normally from the board. This then set a bit on the knock register for me to confirm
The Mitsubishi (JECS) ECUs have an imbuilt filter circuit and I am unable to intercept directly. I am also unable to know with the registers I have suspected if they work, since the filter circuitry may be filtering out my attempts to simulate knock with frequency generators
Yes its a nightmare. How far with which code code? There are about 70 different ECU part numbers for nissans that I deal with. Each code base varies (hence so does the disassembly). I've done basic disassembly (maps and consult addresses) on most of them, and then look into it further as required
Some others like Eric (eg Z32 VG30DETT) and Dave (B13 SR20DE etc) from tunercode have done a tear down on a particular ROM image to see how they work in more detail
No one has a complete memory map/address map from what I know. Parts in these ECUs are ASIC (application speciifc interface chip) so many of the registers are not known. Most of my knowledge comes from the basic consult information (reverse engineered from Techtom unit and published by PLMS) and map information (reverse engineered by the Japanese in ROM editor and associated GRID tuning packages). Working out also from patents in addition to the basic information from the maps you can start figuring out what the code is meant to do
There is an interrupt table in the various ECUs and the vectors are used. For example consult runs from the SCI vector, injection code on RB30 runs from the multipurpose ASIC A/D converter interrupt which takes in CAS signals and processes from there. It tends to vary between various ECUs but most of the maps and functionality remains the same which is good
