Hitachi H8/532 MCU Dump, need information - (Acura Legend)

[sr5guy]

IF THIS IS IN THE WRONG SECTION, PLEASE MOVE
I noticed a post regarding the H8/500 MCU in here, so I posted.


I noticed you guys had some experience with the Hitachi H8 microprocessor. If anyone is able to help us out with this project, I would be EXTREMELY greatful for any information. This is something I am learning step by step so please forgive any inaccuracies. I will be posting up the MCU dump from the ECU's MCU sometime next week when my PLCC-84 breakout socket comes in.

Does anyone have a h8/500 compiler? I noticed that "evoman" or "cboles" on here may have one. So far this is the closest I've come to a group that is familiar with these MCUs.

I dumped the code on the MCU from a 1992 Acura Legend Transmission daughterboard (it's inside of the ECU). I have no way to verify that the dump was successful as I have no knowledge of ASM (or any other programming language). I would like to know if you think the following .bin file and the associated, disassembled .txt file is corrupted or not.

If the dump was successful, I will not feel so bad about possibly destroying a perfectly good engine computer in order to get a dump off of the other, ENGINE COMPUTER MCU. The ECU uses the same exact microprocessor with a different ROM code on it. Thank you for your anticipated assistance.

Information:

The MCU is a Hitachi H8/532. HD6435328. Its an original design of Hitachi's based off of their H8 and specifically 500 series lineup. The chip is 16-bit CMOS microcomputer with 1K-byte high-speed RAM on-chip.

H8/500 disassembler http://other.ditcorp.com/legend/DASMH85.EXE

h8/532 manual/datasheet http://other.ditcorp.com/legend/datasheet.pdf

Official programming guide for the H8/500 series
http://other.ditcorp.com/legend/programming.pdf

TCU.TXT is the de-compiled version. I am not 100% sure that it was done correctly.

-Matt

[sr5guy]

Here is more information:

To sum it up, the Acura Legend (and NSX) ECUs use a H8/532 processor, with internal 32KB rom, which I assume is all machine code. It also has a separate 27c256 ROM chip, of which only 16KB is used at a time (First 16KB is for standard trans, second half is for automatic trans).

The ignition maps, fuel maps and other code is stored on the separate ROM chip. There is a gentleman, Beav, that has already made a very nice program to edit the ignition and fuel maps on the ROM chip. I would like to have some of the more obscure features that those the civic/integra ECUs have.

We are trying to find a way to:
1. Disable closed loop operation
2. Enable the data logging header
3. Find out where in code the ECU interprets the MAP scalars so that the stock ECU can support boost


Threads:

This is the entire, EXTREMELY long thread: http://www.acura-legend.com/vbulletin/s ... 37&page=58 the last page shows my important recent findings, basically WHY the 27C256 ROM is divided into two parts.

This is the fuel/ignition map editor program, Beavedit 2: http://www.acura-legend.com/vbulletin/s ... hp?t=91542

This is the MCU info: http://www.acura-legend.com/vbulletin/s ... post748022

This is my hardware thread with datasheets for the individual components and pictures of the engine computer. I am adding quite a bit to it very soon. http://www.acura-legend.com/vbulletin/s ... hp?t=91516

Thanks again!
Matthew Wallace

[Freon]

gcc supports the H8/300, not sure if that would work for you or not. Do you intend to compile your own code for the processor? You seem a little uncertain, and compiling your own code into the processor is not an easy task.

Yes, the ROM file is machine code. At a glance your disassembly looks somewhat reasonable.

Do you know where the maps are? Is this a mass airflow system or speed density? If it is speed density it may take a new MAP sensor regardless.

[sr5guy]

gcc supports the H8/300, not sure if that would work for you or not. Do you intend to compile your own code for the processor? You seem a little uncertain, and compiling your own code into the processor is not an easy task.

Yes, the ROM file is machine code. At a glance your disassembly looks somewhat reasonable.

Do you know where the maps are? Is this a mass airflow system or speed density? If it is speed density it may take a new MAP sensor regardless.

Let me clarify. I have no knowledge of any programming language. First I wanted to know if the ROM file I dumped off of the tranny MCU was a succesful, non-corrupted dump. From your examination would you say it is? I had an extra transmission board laying around, which uses the exact same MCU with different ROM code. I wanted to be sure I could get a successful read off of the MCU before I potentially destroy a good ECU.

Regarding the compiler, I am simply trying to get all of the tools available so that if I do find someone that is experienced in this field and willing to help, they won't have as much leg work and research to do. They might not need a compiler, but if they do, i am almost positive they would need an H8/500 specific one.

It uses a speed density system. The stock honda map sensor supports up to 10PSI of boost. The fuel and ignition maps are in a separate 27C256 ROM chip. On the PGMFI.ORG board, regarding the civic ECUs, (to which this has little in common) there was a mention that someone was able to find a space in the code where they were able to change an equation and therefore add additional map scalars - supporting up to 10PSI of boost. I hope that this is possible.

My more immediate concern would be to get the datalogging capability and forced open loop to function. This would enable tuning a nice N/A chip. There is a 5 pin communications port that is electrically identical to the one on the civic ECUS. But again, a modification of the code in the civic ROM is required to get it to work properly.

The dis-assembled code inside of that 27C256 ROM chip makes no calls to IO ports, making it very difficult to understand. I am hoping that by examining the MCU's code, it will unlock some keys.

This project is has made MAJOR strides in the past few months, I am hoping we can get the ball rolling!

-Matt

[Evo4Mad]

how did you manage to dump the current ROM you have? do you have the sourcecode for the program that dumped it?

[sr5guy]

how did you manage to dump the current ROM you have? do you have the sourcecode for the program that dumped it?

There was a pin-to-pin diagram in the H8/532 Datasheet (there is a link above) under section 13 "PROM". I simply soldered 35+ wires to it (multiple ground and +5v wires) and patched them into my eprom burner. It read just like a 27c256 chip. No copy protection.

I plan to make an adapter using a plcc-84 breakout socket (found it on ebay) to read the engine computer's ECU. This should give me a much more reliable readout.

-Matt

[YP]

Hi, sr5guy!
You run over my steps . http://forums.openecu.org/viewtopic.php?t=394&highlight=
It will be great to acess Honda flashing via OBD if possible. Please made photos of ECU and Diagnostic connectors if you can.

About TCU.bin - it disassemled sucsessfully via IDA Pro, i think dump is good. But I find some calls to undefined memory space - may be it is external EPROM reading? Please post EPROM data.

Regards, Dmitry.

[sr5guy]

Hi, sr5guy!
You run over my steps . http://forums.openecu.org/viewtopic.php?t=394&highlight=
It will be great to acess Honda flashing via OBD if possible. Please made photos of ECU and Diagnostic connectors if you can.

About TCU.bin - it disassemled sucsessfully via IDA Pro, i think dump is good. But I find some calls to undefined memory space - may be it is external EPROM reading? Please post EPROM data.

Regards, Dmitry.

http://www.acura-legend.com/vbulletin/s ... hp?t=91516 for pictures of ECU.

Where can I get IDA pro? Is it in English?

The undefined memory space is the 27c256 eprom. It must be calling to the transmission shift programs. Can you PLEASE give me the address of the undefined memory? that should identify the transmission shift table.



-Matt[/img]

[prana]

you can get a trial version of ida pro 5 free from www.datarescue.com. The paid version is costly but if you want to support a wider range of cars, you should get the advanced version (more $). Having said that your ecu appears to be supported on the basic version.

I forgot to add, ida pro is a disassembly tool, and you will require a bit of understanding of not just asm but architecture specific asm. You really want to review it before paying big bucks to see if you really need it...

[sr5guy]

you can get a trial version of ida pro 5 free from www.datarescue.com. The paid version is costly but if you want to support a wider range of cars, you should get the advanced version (more $). Having said that your ecu appears to be supported on the basic version.

I forgot to add, ida pro is a disassembly tool, and you will require a bit of understanding of not just asm but architecture specific asm. You really want to review it before paying big bucks to see if you really need it...

Thanks, I got my hands on the advanced version which is able to handle the H8/500 processor. I have no clue about assembly. I still have to read the file from the ECU's MCU. Do you know a programmer experienced in assembly that would be willing to help me out?

-Matt

[peluca]

You can go to pgmfi.org and ask for help there are a few good programmers in that forum.

[prana]

sr5guy - assembly cant be learnt overnight, especially reversing. How much did you pay for the advanced version ? lol you fellas must be loaded, I can hardly afford a dam wideband sensor good on ya... start cutting code - I like to see people that arent afraid to give it a shot!

[peluca]

Maybe this could help you.
Here is the XDF that I made for the TunerPro software the first half of the bin its for the NSX (tested on friends car) so the second half I supose it's for the Legend.
Don't know if the formula for fuel it's OK but I put it that way because the # resembles the others Honda software.

[sr5guy]

AWESOME! That works perfectly with the Legend ROM!!!! Much more advanced than Beavedit!

Hey thanks, I'm currently working on getting the datalogging header to work, do you know if there is a datalogging program to support the NSX ECU? The Legend and NSX ecu's are very similiar and the ROM locations are the same. Would the Tuner Pro program add map scalers to support boost? Beavedit 2: http://www.acura-legend.com/vbulletin/s ... hp?t=91542



If you read this post, on page 58, you will see the details of why the rom is broken into two, the first half is for Automatic cars, the second is for standard cars. All of the other code in the NSX roms is different, as well as the code inside of the MCU.

http://www.acura-legend.com/vbulletin/s ... 37&page=58


-Matt

[sr5guy]

Wow! Tuner pro is awesome! I straightened out the titles and the sorting of the headers a bit. I also made a Legend-specific .XDF that eliminates the unnecessary NSX specific settings. Are you aware of the c-series thread at PGMFI.org? http://forum.pgmfi.org/viewtopic.php?t=9579

I think the Millibars calculation is off, towards the end it should be 1000, instead the last one is 882. Also, is there any way you can put a calculation in there for In. HG?

The fuel numbers look good, totally different from beavedit.

Is there a way to add Map/RPM scalar support?

-Matt