Next step:  Strip the computer out of the case, record the connections inside, make a port map if it has external decoders, dump the rom, and disassemble the code.

Some car computers are easier to reverse- engineer than others.
Yours is old enough that it's at least possible.

You may find that other people have already done some of the work, and posted their findings.  You just have to search for it.


 

Mike Halloran
Pembroke Pines, FL, USA

Well I have trouble understanding my own code which I wrote years ago and this has plenty of comments!

I have disassembled code before, but I'm not very good at making heads or tails of anything.
 

Around 1995, Ford was using a variant of the Intel 8096 in their ECUs, so real tools are available.  Schematics and (disassembled) source code have been posted to the net for various program loads.

I don't know what you'll find in a Kia/Aspire/Mitsubishi; could be anything, but it's probably something that was made in volume and used in many different models.

I didn't say disassembly was easy... but it can be a fun challenge.  After a while, you can not only understand the program, you can see into the programmer's head, which is a very weird feeling.

<tangent> <brag>
I used to an eXtreme Programmer, 20 years before anybody called it that.  I wrote my own disassembler, that could resolve short forward references in one pass, using a technique stolen from Leor Zolman.  

I was working for a multinational at the time, and found a bug in a rom in one of our products.  While investigating that, I met the programmer who wrote the code, in French.  I was able to describe to him how the bug looked, without knowing what labels he had actually used.  He had written a clever macro, used it liberally, and just once passed it the wrong argument, causing it to generate bad code.  He was flabbergasted that I had figured out he used a macro, and how it worked.  He asked me if it wouldn't be easier to have the actual source code.  I said, sometimes, no, because the comments often get obsoleted and mislead the reader.
</brag> </tangent>

<snark>
HTML is a stupid language, written by people who knew something about computers but nothing about langage, so that people who knew nothing about computers or language could program the computers.  The mind boggles.
</snark>

 

Mike Halloran
Pembroke Pines, FL, USA

I can imagine a few uses for a 'headlight on ' flag

-increase idle speed
-detect if current draw has actually increased - if not a bulb may have failed
-maybe use it to illuminate an indicator on the IP if the EEC is integrated with the BEM (body electronic module, the EEC's evil twin)

There are probably others.

Without being rude, if I were to put any time into disassembling an EEC I'd start with a more interesting car!

Cheers

Greg Locock

SIG:Please see FAQ731-376: Eng-Tips.com Forum Policies for tips on how to make the best use of Eng-Tips.

I'd go to a junkyard and get a dozen ECUs from different models that used the same box.  Then a diff comparison of all the binaries would tell you what parts of the code were shared, and what parts were customized for each model.

Then you can start making educated guesses about which block does what.

 

Mike Halloran
Pembroke Pines, FL, USA

So far as using a more interesting car ECM...

Well I also have a GMC truck and four factory service manuals for it. However those manuals are documented *very* well, so no need to go hunting on the internet - just read the documentation!

What peaks my interest are things which are not well documented, then it becomes a challenge.

I forgot I did once map the "user memory" of a buggy Free to Air satellite receiver I have. I used a HEX editor along with the buggy manufacturer's channel editing software. I would write a unique word with the channel editor, then search for it with the hex editor. Then once I knew the memory map, I was able to make some changes so it would work as it should.

Anyway I found many ECM reverse engineering sites on the internet. Plenty to learn about! Thanks...
 

Quote (bill190):

Then I have noticed a difference between two same model computers, but with slightly different numbers. One is "B3H7 18 881B" and the other is "B3H7 18 881C". The former has instrument cluster upshift light functionality and the latter does not.

If I had to guess I'd say one is for manual and the other is for auto transmissions. You would probably also find that there is a TCU input signal from the one without the shift light.

Also don't forget the OBDII info is stored in the ECU, if this ECU was a holdover from before 1995 (OBDII official adoptation) it would have had a bunch of OBDI and other random diagnostic inputs.
 

Any links to sites for ecu code disassembly?  

I found this aftermarket ECU with the code posted on this site as well as all sorts of technical info...
http://www.megamanual.com

Also I am reading this very geeky book which does not go into ECU details, but tells quite a bit about various automotive computer networks, systems, and sensors...

Automotive Electrics And Automotive Electronics by Robert Bosch
http://www.amazon.com/Automotive-Electrics-Electronics-Completely-Handbooks/dp/0470519371

Tryhere

http://www.diy-efi.org/