Memory dump of ECU

[b3lha]

Joe (SVXistentialist) has kindly lent me a UK TCU. I have extracted the code with a view to finding out what the "Economy Mode" button does on the European cars.

It turns out that Joe was exactly right when he hypothesised that the Economy switch locks out power mode. With the Economy switch on, power mode will not engage when you floor the throttle. This seems pointless to me. If I floor the throttle it's because I want some speed and I want it now. So I decided to have a go at changing the program to make this switch a little more useful - like the power switch on JDM cars.

Here is the part of the program that decides whether to use normal or power mode on a UK TCU:

e5f7 12 8a 02 18 brset (0x008A), 0x02, [0xE613]
e5fb 12 3a 80 14 brset (0x003A), 0x80, [0xE613]
e5ff 12 11 20 10 brset (0x0011), 0x20, [0xE613]
e603 12 12 40 0c brset (0x0012), 0x40, [0xE613]		; Manual Switch
e607 12 11 40 08 brset (0x0011), 0x40, [0xE613]		; Economy Switch
e60b 96 4d       ldaa (0x004D)
e60d 84 07       anda 0x07
e60f 81 03       cmpa 0x03				; Stick in position D,3 or 2
e611 25 03       bcs [0xE616]
e613 5f          clrb		Branch Target from e5f7, e5fb, e5ff, e603, e607
e614 20 47       bra [0xE65D]
e616 5f          clrb		Branch Target from e611
e617 ce c8 fe    ldx 0xC8FE
e61a 96 18       ldaa (0x0018)
e61c 5f          clrb
e61d a1 00       cmpa (X+0x00)
.....
e65d d7 5a       stab (0x005A)		Branch Target from e614, e656, e65a
e65f 39          rts

The relevant line of code is at location e607. It says if the Economy switch is on, goto location e613. The command at location e613 says set the B register to zero and go to location e65d. At e65d it stores the value of the B register at location 005a. This is the variable that indicates which shift map to use. Compare this with the JDM program that was discussed way back in this thread.

e76f 12 8a 02 20 brset (0x008A), 0x02, [0xE793]
e773 12 3a 80 1c brset (0x003A), 0x80, [0xE793]
e777 12 11 20 18 brset (0x0011), 0x20, [0xE793]
e77b 12 12 40 14 brset (0x0012), 0x40, [0xE793] 	; Manual Switch
e77f 13 11 40 04 brclr (0x0011), 0x40, [0xE787]		; Power Switch
e783 c6 02       ldab 0x02
e785 20 55       bra [0xE7DC]
e787 12 5a 02 08 brset (0x005A), 0x02, [0xE793]
e78b 96 4d       ldaa (0x004D)
e78d 84 07       anda 0x07
e78f 81 03       cmpa 0x03				; Stick in position D,3 or 2
e791 25 03       bcs [0xE796]
e793 5f          clrb		
e794 20 46       bra [0xE7DC]
e796 ce c9 04    ldx 0xC904
e799 96 18       ldaa (0x0018)
e79b 5f          clrb
e79c a1 00       cmpa (X+0x00)
.....
e7dc d7 5a       stab (0x005A)
e7de 39          rts

In the JDM code, the command at location e77f says if the Power switch is off, goto e787. If not (ie. Power Switch is on), set the B register to 2 and go to e7dc. At e7dc it stores the value of the B register at location 005a, which is the variable that indicates which shift map to use. We previously determined that 005a is 0 for "power mode not engaged", 1 for "power mode engaged due to throttle" and 2 for "power mode engaged by switch"

As a first attempt, I have modified the UK TCU code as follows:

e5f7 5f          clrb
e5f8 12 8a 02 61 brset (0x008A), 0x02, [0xE65D]
e5fc 12 3a 80 5d brset (0x003A), 0x80, [0xE65D]
e600 12 11 20 59 brset (0x0011), 0x20, [0xE65D]
e604 12 12 40 55 brset (0x0012), 0x20, [0xE65D]		; Manual Switch
e608 12 11 40 04 brset (0x0011), 0x40, [0xE610]		; Economy Switch
e60c c6 02       ldab 0x02
e60e 20 4d       bra [0xE65D]
e610 96 4d       lda (0x004D)
e612 84 07       anda 0x07
e614 81 03       cmpa 0x03				; Stick in position D,3 or 2
e616 24 45       bcc [0xE65D]
e618 ce c8 fe    ldx 0xC8FE
e61b 96 18       ldaa (0x0018)
e61d a1 00       cmpa (X+0x00)
.....
e65d d7 5a       stab (0x005A)		Branch Target from e5f8, e5fc, e600, e604, e60e, e616, e656, e65a
e65f 39          rts

Rather than having a separate "clrb" for each possible execution path, I have put a single one at the start, and I have changed the destination of the "brset" instruction to go directly to e65d. This creates a few bytes of space where I can insert the extra code. The instruction at e608 says, if the economy switch is on, goto e610, which carries out the normal processing - power mode on kickdown. However, if the ecomony switch is off, the instruction at e60c will set the B register to 2 and go to e65d, which stores the value of the B register at location 005a. Power mode engaged.

In summary, the modified program enables "power mode on demand" when the economy switch is on and "permanent power mode" when the economy switch is off.

I think this is potentially a cool mod for the UK and Euro SVXes. However, one problem remains: How do we get the modified program into the TCU. If anybody has any bright ideas about that then I would like to hear them. There is a space laid out on the circuit board to add an EPROM socket. But what type of EPROM? Maybe the same 27C1028 type used by the ECU? And how do you tell the TCU to use the new one rather than the original one? There doesn't seem to be any obvious resistor to cut like on the ECU. Anybody know the answer to this? Or how to go about figuring it out? I really want to test this out.