With 2 different, and not really related, threads going; I thought I'd start a dedicated TCM reverse engineering thread here in the tuning section.
I dusted off the cobwebs in my old notes (and head) this morning, and here's what I came up with.
The '91 TCM memory MAP:
From what I can tell looking at the .bin Straxx pulled off the chip from an '91 TCM, the memory map looks like this:
91 TCM Memory MAP:
0x0000 to 0x00FF -- RAM (on-board 6811 uP)
0x0100 to 0x7FFF -- EPROM (External chip - ??)
0x8000 to 0x807F -- Static RAM (on-board PIA chip, proprietary ChryCo)
0xA000 to 0xA03F -- System Registers (on-board 6811uP)
0xB600 to 0xB7FF -- EEPROM (on-board 6811 uP)
0xE000 to 0xFFFF -- 8K Mask ROM (on-board 6811 uP)
There was a 6811 version available with an 8k mask ROM (that is, a ROM programmed by Motorola at the factory). It's location in the MAP is selectable, but if it falls in the oxE000 to 0xFFFF range, it would cover all of the missing code and interrupt vectors perfectly. In addition, I can't find any system config in the .bin file (which would be required to move the system registers up to 0xA000), so it also must be in the mask ROM.
EDIT:
The '89 TCM memory MAP is different. It looks like this:
0x0000 to 0x00FF -- RAM (on-board 6811 uP)
0x1000 to 0x103F -- System Registers (on-board 6811uP)
0x6000 to 0x607F -- Static RAM (on-board PIA chip, proprietary ChryCo)
0xB600 to 0xB7FF -- EEPROM (on-board 6811 uP)
0x8000 to 0xFFFF -- EPROM (External chip - 87C257)
1st step - Bootstrap an '89 TCM and see if I can read the entire 64k memory space (well, at least from 0x0100 thru 0xFFFF). If I can, then we would have the 'missing' code and could really start to understand what's going on.
2nd step - Once we have a full image of the ROM space for the '89 TCM, start comparing the code to the published flowcharts (IE, from the published patents) and reverse engineer it. We need to figure out the table format and get that added to MP Tune. That will allow for 'binary' editing as a start. Then we need to make a new source, like we have for the ECU's.
In the meantime, we should start collecting various .bins, much like we have for the ECU calibrations. Once we get the code figured out, we'll want to have a reference database to compare TCM calibrations to. Also, once we have the early code reverse engineered, we could use it as a stepping stone to reverse engineer the later software. Maybe add stickshift functions, etc.