The post turns out to be some kind social activity, free from specifying technical data. Good night from here.
Sorry the EEPROM is 32kb on the MCU itself. I thought it was also called flash memory but no it is not like a USB stick or something like that if that's where the confusion was. To be honest I'm not a memory expert so I wouldn't really know the difference I just thought that all those sorts of rewritable memories were considered to be “Flash”. The ECU is from a late 90s/very early 2000s watercraft with a 2 stroke engine.
I'm attempting to get a dump from the MCU that is inside of the ECU. It has been depotted to the MCU and the aforementioned pads. The sketch I put up is the entire circuit, as far as what I have wired. The ECU is somewhat basic, it power's on when a safety key is installed closing a switch. At that point with the safety switch cap installed it permits the starter to be used. Once that happens it looks at the trigger coil in the engine and generates a signal to an ignition coil to make spark at the appropriate time based on the timing map that is being used. It also limits engine rotating speed and it has an offset factor for adjusting base timing to compensate for mechanical parts stacking in manufacturing. In comparison to Modern 4 cycle or automotive ecu's it's really quite simple.
I will add the MCU part number to the graphic, but there is no literature for it online, it was an 80pin QFP packed of a chip that originally had more pins, so somewhat scaled down. Interestingly the same of very similar chip was used in a Suzuki motorcycle called a TL1000 and I acquired the pin identification from an enthusiast of those bikes.
@OnlyKindaSlow
A well focused photo of the circuit board would be helpful.
@Railroader apologies, social such and such was not at all a goal. Thank you for taking time to request the graphic, im somewhat green on these subjects. I've always wanted to use the Arduino for more but sadly my business doesn't permit me the time, so I'm sort of doing my best with what I've got for knowledge and filling in the gaps where my experience ends trying to accumulate as much knowledge as possible. I try to do it all by myself but it's not very practical. Thus far it hasn't worked, hence my inquiry
@EmilyJane unfortunately that's a bit of a tall order because the entire board is potted and removing it without doing damage to the board is somewhere between extremely difficult and highly unlikely. I've depotted a couple that were already ruined so I do have one picture but it still has quite a bit of residual potting Compound on it. Interestingly enough it is actually the same board, I'm not sure how valuable a photo would be but I could take one and post it
Maybe we can identify some of the crucial parts. Is where you are doing your interface an actual connector?
Where I'm doing my interface is a programming or test header located on the board just adjacent to the chip itself. Basically ate blank pads that just permit contact points.
I do know or suspect that later programming when the addresses are known is handled through a K line that is available through one of the exterior pins
Taken, reading Your reply. For curiosity, here is the advice/request from forum: How to get the best out of this forum - Development Tools / IDE 1.x - Arduino Forum
It tells what information we want to see in order to give precise advice and avoid guesses and a ping pong dialogue.
The topic is by now beyond where I can contribute. Good luck!
I will take a SWAG and say it is probably a MC68HC11???. Here is one of the data sheets: https://www.nxp.com/docs/en/data-sheet/M68HC11E.pdf See if this sorts out as the pinout:
Here is another link, they have a lot of manuals. MERCURY 40 TWOSTROKE OPERATION, MAINTENANCE AND INSTALLATION MANUAL Pdf Download | ManualsLib
Have you contacted the dealer and tried to get a service manual? I would also expect the code was written in assembler which was more popular at that time.
That’s actually somewhat close, its a MC16HC916 chip, but in a custom package that is not documented anywhere.
There's basically zero help in the world on this. I've got all the manuals Under the Sun but none of them have anything to do with this kind of thing.
I started this thread mostly because I was having this very strange issue. But in part due to the questions people asked early on, I isolated the ground issue which in fact wasn't actually a ground issue at all, it was the fact that unbeknownst to me a non-powered Arduino hooked up to a powered circuit will actually appear as a draw. So my 5 volt rail was dropping from 5 volts down to about 5 volts because it doesn't have the capacity to have an Arduino sitting off on the side connected to its pins which are powered in their idle state.
For the time being the initial query I had is actually solved. I did a really fabulous disaster of making this thread. It was intended to just ask one basic simple question but I put in too much information. What I should have done was just asked if an Arduino can appear as a load but when I included all the information about the actual process I was going through, things got a little bit modeled. Luckily I was able to find some helpful information here from some other contributors who had similar situations with an Arduino appearing as a load and that answered that question. Now I've got a whole other situation happening and it appears to be principally coding. The hardware appears to be working as it should so the sketch at this point is kind of a bit of a moot point. What's really happening is I'm getting a dump but all the addresses are appearing as zeros so first it was determined that my chip bus frequency was not a match for the onboard oscillator, then I had to work through a powering up sequence that would allow everything to talk and now I'm trying to see if my sketch sends the proper commands.
In short, I did a really terrible job of making my first question post here. I'm a very well still need assistance, and your graphic seems to confirm that the pinouts that I have are correct. It's a little blurry so I can't see everything, but some of it that I can tell seems to confirm my findings, so thank you very much for that!
In fact thank you to everyone who commented and took the time to read this Runaway Train. When I run into a snag and I need help it will most likely be a coding issue and not Hardware so I will start a clean fresh thread in the appropriate location, with the appropriate information structure the way it should be and so on according to the guidelines set forth in the getting the most out of this forum digest document. Sorry so long, but I wanted to be thorough
fwiw, my package is qfp80 pin, but still not super far off. good SWAG
Just a note: The MC68HC916 family became availability in the mid-1990s
Documented public introduction of 916 derivative: May 1997. The Original MC68HC916 devices were offered as:
Mask ROM (factory programmed) OTP (one-time programmable EPROM)** versions for development / low volume They do not have in-system erasable Flash in the base versions. Hopefully this helps. With it being ROM I do not think you can access it. Some of there processors, not necessarily the HC16 had a special test mode that would allow access but it was never published.
FYI now obsolete but the part number for the qfp80 pin with 32k flash was MC68HC916P1CAA16.
Now that I see what chip you have the 8 pin connector makes sense. Those are the signals necessary to program the FLASH in circuit. Additionally, you need access to the flash programming/erase voltage pin. I can't find the data sheet for the particular variant you have but it may have an additional 2K of block erasable FLASH, BEFLASH. Maybe your ignition curve table is stored in that.
Indeed, those things are correct. Factory race guys in the late 90s had a software tool to access whatever portion of the memory where the specific tables that we need are located. All have lost or discarded the software because the machines simply fell out of favor as new models were released with more current technology and 2 stroke power became a more legacy type of power. im not aware who provided or made it, but the 3 factory race guys in know do not have it any longer and in fact aren’t even involved in racing anymore.
According to the sheets I've seen , there is a 2K beflash area and a 32kb eeprom. I was not aware if changeable items would be located there or how to access it specifically. There is another ROM chip on the board , I got a dump from that sometime ago and I believe I did it correctly as it used in Arduino sketch that others had used and the chip itself was very common. If indeed there is such an area, that might be where those small maps and settings would live.
Unfortunately I'm not an expert in MCU architecture. My understanding is that the small external ROM chip is where the ECU dumps running information when it is started that is later erased when the ECU is powered down or simply written over on the next startup cycle?
I do however know that the memory locations are absolutely accessible via a K line from the exterior. As one of the factory race guys was kind enough to tell me that there was no cutting or drilling required
Furthermore, we have Factory diagnostics for these, but those Factory Diagnostics tools do not access memory related to performance, just more basic things a legacy dealer or service tech might have used. The capability exists to write new maps, but it was obscured to those users. Since we have those tools, we can easily make changes that will or should identify areas in the memory where that data is stored
The "race guys" were probably using a BDM for that chip family.
@EmilyJane that is an interesting observation about the flash programming/erase voltage pin. If that is required, I I would have to think that it would be broken out on the board in order to be accessed because it is not practical to access actual legs on the MCU as I believe the pitch is somewhere in the vicinity of 0.8 mm. Even with my Pogo pins I wouldn't trust getting on to those things LOL
Now I'm green as is probably glaringly obvious, but I thought that BDM was only a function at board level and not something that you could do from the exterior via a K line or such
It connects to those 8 pins that you have access to. I have developed products with chips in the 68HC16 family in the past and programming definitely needs the VFPE pin. Not necessary to read the memory.
Actually, I think I am misremembering that. It seems like we were able to change program memory with the BDM tool.
Check this note from NXP
MC68HC16R1UM.pdf.zip (2.7 MB)