ECU Reverse Engineering Step 1

Going down the rabbit hole towards understanding the ECU, that I had had bought a few days ago, led me to realize based on ECU model numbers that BPL9-18-881B is the ECU for a 1995 Miata rather than a 1999 (Miata.net forum reference). I was disappointed and reached out to the seller on Facebook who did say they will send me the 1999 version and it was an error on their part, but so far they have not fixed their error. I consider this a loss of $60. I decided to move on, however. I bought a 1999 ECU on eBay and it should arrive in a week or so. Meanwhile, I will continue with this 1995 ECU since it will be cool to build two test benches to understand the difference between the cars.

So while I wait for either the 1999 ECU to show up or for a 1995 instrument cluster and wiring harness to be purchased by me as backup, I decided to find data sheets for the chips IC698 and IC699 as in the images below.

Figure 1. IC699 points to the CPU of the board

Figure 2. IC698 points to the EPROM on the board

It took a while to figure out that for IC698 I had to search for C531001CPI which led me to the datasheet for a 32-pin Toshiba ROM chip TC531001CP-12 and the datasheet was found here. You can download it here.

IC699 however has been hard to find datasheets for. All I have figured out is that the chip number is SC402655CFN185 made by Motorola, and also made by Freescale as SC90078EFR2. From forums on miata.net there is an indication that this chip is based on the 68HC11 platform. It’s funny to me that I worked on this exact platform during a mechatronics course in college, and had absolutely no interest in the project. How times change ! ¯\(ツ)/¯

I searched on Baidu, Bing, Google and DuckDuckGo and all I got was Request For Quote (RFQ) forms that I filled up asking for data sheets. So far no one has responded with a data sheet, some have responded though saying they do not have it. But then why does your website show it ? Clearly they just copied a bunch of processor names from somewhere and are claiming to sell it.

Interesting links that discuss ECU tuning and reversing are listed here:

• Miata.net links in order of importance:
  • Socketing ECU ?. As of 18th May 2019, I read all the 801 posts! Took several hours to do.
    • Downloaded user BaktusBror’s ECU ROM file from this post.
    • Downloaded user pudhed’s 1994 ECU ROM and analysis file from this post.
    • Downloaded user MartinY’s Japan market 1994 ECU ROM file from this post.
    • Downloaded user big_turbo’s 1998 ECU ROM file from this post.
    • Downloaded user gibsonconsulting’s 1995 California ECU ROM file from this post.
    • Downloaded How to disassembling and reassemble.doc from user BaktusBror’s post.
    • Downloaded user Rhinoman’s 1991-93 (1.6L engine) ECU ROM disassembly file, which used to be available here. The actual binary is mirrored here. A schematic is available(mirror). A different version’s binaries called B64F.bin and B66B.bin were available.
    • Downloaded user QuickdrawCraig’s 1999 ECU ROM which is likely that of an 68HC(9)16. Will know when my 1999 ECU arrives. The byte order of this binary needs to be swapped.
    • Found na6edit.exe and na8edit.exe, a ROM editor from Sigehisa’s dead site
    • TunerPro’s software that supports the exact ECU that I have
    • BURN2 programmer that might be needed to reprogram the EEPROM chip, although only a 28-pin one. Claims exist where it fails the 32-pin chip, which is what I have.
    • A short summary post about ROM addressing in the 1994 ECU.
    • Many used 27SF512 ROM chips to update their modified binary while using a ZIF socket to be able to swap the ROMs
    • 1999 onwards ECU processor might be a 68HC(9)16 variant with 132 pins, which needs a Background Debug Mode (BDM) interface to extract the ROM contents from the chip.
      • A BDM parallel port module was built by Rhinoman and may still be available here (mirror) and was discussed on activeboard.com.
      • The Motorola original AN1230.pdf document also has information on how to build the BDM reader.
    • A way to check pinout validity as per the data sheet, in case multiple possible variants with the same number of pins exist, is to make sure continuity tests pass.
  • Factory ECU Data Revealed
  • Programming the ECU
  • Reverse Engineering the NC ECU
  • Raise Rev Limit on Factory ECU
  • Toto’s Crainiotomy (‘96 OEM)
• Asahi-Net (Japanese site, so use Google Translate). This site has plenty of details on various intricate parts of the ECU.
• Chubu contacted Mazda to get info. He has some other posts that might be useful.
• Mazda Probe forum’s Google Cache. This led to another chip number SC402617FN that is also present in the Miata.net forum post
• EmbeddedRelated forum link to SC402617FN. This site had good information like the fact that SC in a Motorola family means semi custom, which makes sense that this is a System-on-Chip style microcontroller. The posts also state that the chip is an HC11 with enhanced units for timers and peripheral interfaces.
• Freescale Archive for MC68HC11K(mirror). The MC68HC11K4 has 84 pin PLCC form that is the form of our SC402655CFN185 chip and can address 128K bytes of RAM which is the RAM in our C531001CPI chip.
• MC68HC11G5(mirror) might be the chip too. We have to compare disassembly and see.
• Freescale Archive for MC68HC11P2(mirror) which may also be an option. NXP(mirror) also has the datasheet.
• MC68HC16R1UM(mirror) might be the variant in ECU models made in or after 1999.
• DHC11, an 68HC11 disassembler tool
• Supramania links (to learn other’s techniques): Disassembly analysis
• Honda Integra forums: ECU chip basics
• ECU Hacking blog (this site has limited info though)