Page 1 of 7 12345 ... LastLast
Results 1 to 20 of 136

Thread: TCM Reverse Engineering Project

  1. #1
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    TCM Reverse Engineering Project

    With 2 different, and not really related, threads going; I thought I'd start a dedicated TCM reverse engineering thread here in the tuning section.

    I dusted off the cobwebs in my old notes (and head) this morning, and here's what I came up with.

    The '91 TCM memory MAP:

    From what I can tell looking at the .bin Straxx pulled off the chip from an '91 TCM, the memory map looks like this:

    91 TCM Memory MAP:

    0x0000 to 0x00FF -- RAM (on-board 6811 uP)
    0x0100 to 0x7FFF -- EPROM (External chip - ??)
    0x8000 to 0x807F -- Static RAM (on-board PIA chip, proprietary ChryCo)
    0xA000 to 0xA03F -- System Registers (on-board 6811uP)
    0xB600 to 0xB7FF -- EEPROM (on-board 6811 uP)
    0xE000 to 0xFFFF -- 8K Mask ROM (on-board 6811 uP)

    There was a 6811 version available with an 8k mask ROM (that is, a ROM programmed by Motorola at the factory). It's location in the MAP is selectable, but if it falls in the oxE000 to 0xFFFF range, it would cover all of the missing code and interrupt vectors perfectly. In addition, I can't find any system config in the .bin file (which would be required to move the system registers up to 0xA000), so it also must be in the mask ROM.

    EDIT:
    The '89 TCM memory MAP is different. It looks like this:

    0x0000 to 0x00FF -- RAM (on-board 6811 uP)
    0x1000 to 0x103F -- System Registers (on-board 6811uP)
    0x6000 to 0x607F -- Static RAM (on-board PIA chip, proprietary ChryCo)
    0xB600 to 0xB7FF -- EEPROM (on-board 6811 uP)
    0x8000 to 0xFFFF -- EPROM (External chip - 87C257)

    1st step - Bootstrap an '89 TCM and see if I can read the entire 64k memory space (well, at least from 0x0100 thru 0xFFFF). If I can, then we would have the 'missing' code and could really start to understand what's going on.

    2nd step - Once we have a full image of the ROM space for the '89 TCM, start comparing the code to the published flowcharts (IE, from the published patents) and reverse engineer it. We need to figure out the table format and get that added to MP Tune. That will allow for 'binary' editing as a start. Then we need to make a new source, like we have for the ECU's.

    In the meantime, we should start collecting various .bins, much like we have for the ECU calibrations. Once we get the code figured out, we'll want to have a reference database to compare TCM calibrations to. Also, once we have the early code reverse engineered, we could use it as a stepping stone to reverse engineer the later software. Maybe add stickshift functions, etc.
    Last edited by ShelGame; 12-12-2015 at 05:08 PM.
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  2. #2
    turbo addict
    Join Date
    Jan 2006
    Location
    Hazelwood, MO
    Posts
    6,566

    Re: TCM Reverse Engineering Project

    Thank you for doing this, Rob!

  3. #3
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    I have 17 days off starting on the 18th. I'll try to get a benchtop boot setup working by then. I had one at one point, but it never worked right. I ended up cannibalizing it for something.
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  4. #4
    Supporting Member Turbo Mopar Contributor
    Join Date
    Jun 2006
    Location
    Spearfish SD
    Posts
    2,038

    Re: TCM Reverse Engineering Project

    Quote Originally Posted by ShelGame View Post
    I have 17 days off starting on the 18th. I'll try to get a benchtop boot setup working by then. I had one at one point, but it never worked right. I ended up cannibalizing it for something.
    17 days! i'm jealous you lucky dude. lmk if i can help disassemble or with the disassembly. i have 4 days off
    89 Voyager LE, 2.5T2 - rest in peace
    87 Charger Shelby T2 (2.4 conversion in process)

  5. #5
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Yep. One benefit of working in the auto industry...
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  6. #6
    Boost, it's what's for dinner... Turbo Mopar Staff Aries_Turbo's Avatar
    Join Date
    Dec 2005
    Location
    Warsaw, NY
    Posts
    8,838

    Re: TCM Reverse Engineering Project

    subscribed.....

    Quote Originally Posted by turbovanman
    This one is easy, I have myself to blame, I rush things, don't pay attention to gauges when I should, change to much stuff at once then expect miracles, the list is endless.

  7. #7
    Rhymes with tortoise. Turbo Mopar Staff cordes's Avatar
    Join Date
    Dec 2005
    Location
    Tuscola, IL
    Posts
    21,441

    Re: TCM Reverse Engineering Project

    I guess I'll be the first to ask what TCM stands for.

  8. #8
    turbo addict
    Join Date
    Jan 2006
    Location
    Hazelwood, MO
    Posts
    6,566

    Re: TCM Reverse Engineering Project

    Transmission Control Module

  9. #9
    Rhymes with tortoise. Turbo Mopar Staff cordes's Avatar
    Join Date
    Dec 2005
    Location
    Tuscola, IL
    Posts
    21,441

    Re: TCM Reverse Engineering Project

    I see. What trans was this for? The 604?

  10. #10
    Moderator Turbo Mopar Staff Force Fed Mopar's Avatar
    Join Date
    Dec 2005
    Location
    Greenville/Spartanburg SC area
    Posts
    7,557

    Re: TCM Reverse Engineering Project

    Quote Originally Posted by cordes View Post
    I see. What trans was this for? The 604?
    Yes, also known as the 41TE in later models.

    - - - Updated - - -

    Quote Originally Posted by ShelGame View Post
    In the meantime, we should start collecting various .bins, much like we have for the ECU calibrations. Once we get the code figured out, we'll want to have a reference database to compare TCM calibrations to. Also, once we have the early code reverse engineered, we could use it as a stepping stone to reverse engineer the later software. Maybe add stickshift functions, etc.
    I'll start looking in the local yards and grab as many different year and model units as I can.
    Rob M.
    '89 Turbo GTC

    2.5 TIII stroker, 568 w/ OBX and 3.77 FD

  11. #11
    Supporting Member Turbo Mopar Contributor mopar-tech's Avatar
    Join Date
    Dec 2005
    Location
    Oakdale CT
    Posts
    2,419

    Re: TCM Reverse Engineering Project

    Wish I could help, I had a few but gave them all away.


    Working on clearing the decks.

  12. #12
    Supporting Member Turbo Mopar Contributor 2.216VTurbo's Avatar
    Join Date
    Dec 2005
    Location
    SoCal the OC
    Posts
    6,675

    Re: TCM Reverse Engineering Project

    It's sad when you already know you'll have nothing to contribute to a thread, but I am gonna lurk and try to learn something

    AJ (no More Alan) 84 Rampage RT TIII/568 Quaife 87 GLHS dealer optioned Red 16V Masi/568/Quaife
    90 Masi 16V White/Ginger/Black
    89 TC Masi 16V Red/Ginger/Black
    86 GLHS #110 RoadRace Built 89 CSX-VNT Recaro Car
    89 Turbo Mini 'Woody' 85 GLHT 'RedBox'
    2014 Explorer DD'r 3.5Twin Turbo Ecoboost AWD and 500HP
    My profile page has over 20,000 views, I'm somebody LOL

  13. #13
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Gotta love Chrysler's thoroughness with the A604 patents. The bootstrap signal is on a separate pin, much like the SMEC. Of course, it's not a documented use in any of the 60-way pinouts. Luckily, I have several EATX flash adapters (I stole the flash adapter boards to use with the FCC flash stuff). Pin 48 is un-used in all of the 60-way pinouts, but has a wire going back to the DRBII connector. That must be it.

    So, it seems 'all' I need to do is connect an FTDI cable to the Rx, Tx, and GND lines; then provide a toggle for 12v power and a pushbutton to the boot wire.

    Reading the patent...

    The test mode block 3300 is used to permit a test mode program to be downloaded into the RAM memory of the MCU for testing the transmission system.
    That's exactly what we need to do to read the entire memory array.
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  14. #14
    Rhymes with tortoise. Turbo Mopar Staff cordes's Avatar
    Join Date
    Dec 2005
    Location
    Tuscola, IL
    Posts
    21,441

    Re: TCM Reverse Engineering Project

    Quote Originally Posted by ShelGame View Post
    Gotta love Chrysler's thoroughness with the A604 patents. The bootstrap signal is on a separate pin, much like the SMEC. Of course, it's not a documented use in any of the 60-way pinouts. Luckily, I have several EATX flash adapters (I stole the flash adapter boards to use with the FCC flash stuff). Pin 48 is un-used in all of the 60-way pinouts, but has a wire going back to the DRBII connector. That must be it.

    So, it seems 'all' I need to do is connect an FTDI cable to the Rx, Tx, and GND lines; then provide a toggle for 12v power and a pushbutton to the boot wire.

    Reading the patent...



    That's exactly what we need to do to read the entire memory array.
    I'm pretty sure that's what the guy from Cyberdyne Systems said.

  15. #15
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Built a benchtop TCM reader this afternoon. Got the upper memory sucked out of the '89 TCM no problem. So, now we have the full (nearly) 64k image to work with. Including the EEPROM ,so we can see what data is being stored there.

    I'll need to modify the modular bootloader, and ask Morris to make some mods to the ECU boot utility to be able to read the entire 64k image in one shot (minus the first 100 bytes of RAM).

    I'm leaving for Germany again tonight. So, I'll have 16 hours or so (+ time in the hotel) to combine the upper and lower .bins and make a full dis-assembly of it.

    Look for updates from Germany this week.

    BTW, this benchtop reader should work for all of the 'early' TCM's at least (any that used a 6811). All of the TCM's I have are 6811 based. At some point, Chrysler switched to a 68HC16 processor. I'm not sure this will work with those, as it didn't use the same type of bootstrap mode for flash programming.

    If I de-pot this '89 TCM, I'm sure I could install an SBEC flash module in it and make it flashable; for development purposes. I'd like to see if it has the pins for the autostick switches populated and run to the I/O portion of the board. That would make things interesting, wouldn't it?
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  16. #16
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Quote Originally Posted by cordes View Post
    I'm pretty sure that's what the guy from Cyberdyne Systems said.
    Miles Dyson. My hero. Nearly had my wife convinced to name our first son Jonathan Conner. She caught on, he ended up Jonathan David, instead.
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  17. #17
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Here's the full .bin and a first run through the dis-assembler. Nearly no comments added yet. It's basically un-readable.

    '89 TCM Dis-assy

    I will update this link in the future with the latest dis-assembly, for those interested.

    EDIT (12/13/2015): Download updated with the '89 TCM .bin I read yesterday; and the completed 1st-pass dis-assembly (still basically no comments). Very much a work in progress.
    Last edited by ShelGame; 12-13-2015 at 07:24 AM.
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  18. #18
    Visit www.boostbutton.com... Turbo Mopar Contributor ShelGame's Avatar
    Join Date
    Dec 2005
    Location
    Whitmore Lake, Michigan, Unite
    Posts
    9,918

    Re: TCM Reverse Engineering Project

    Well, one step forward, 2 steps back. It's very clear that the upper .bin I read today does NOT go with the lower .bin provided by Straxx from reading the chip. Addresses that should match, don't. I'll need to work with Morris this week to get the MPTECU utility to read the full 64k (minus the first 100 bytes).

    EDIT: Yeah, I see now the PN's do not match. The .bin provided by Straxx is 4672002. Which seems to be for a '91 3.0. The upper .bin I read is PN 5234678. I wonder if it's complete...
    https://db.tt/SV7ONZpQ
    Rob Lloyd
    '89 Daytona C/S

    2.5 T1 Auto
    13.24 @ 100.5mph
    NHRA #3728 AF/S

    boostbutton.com
    tuning wiki

  19. #19
    Boost, it's what's for dinner... Turbo Mopar Staff Aries_Turbo's Avatar
    Join Date
    Dec 2005
    Location
    Warsaw, NY
    Posts
    8,838

    Re: TCM Reverse Engineering Project

    pretty cool none the less.

    that 604/awd stuff i have laying around may get some use after all.

    Brian

    Quote Originally Posted by turbovanman
    This one is easy, I have myself to blame, I rush things, don't pay attention to gauges when I should, change to much stuff at once then expect miracles, the list is endless.

  20. #20
    turbo addict Turbo Mopar Contributor
    Join Date
    Dec 2005
    Location
    Seattle
    Posts
    7,063

    Re: TCM Reverse Engineering Project

    Quote Originally Posted by Aries_Turbo View Post
    pretty cool none the less.

    that 604/awd stuff i have laying around may get some use after all.

    Brian
    Autostick and flashable programming yum. Selling points to more than one niche.
    Set it and forget it bracket or heads up racing tune too...
    Brent GREAT DEPRESSION RACING 1992 Duster 3.0T The Junkyard - MS II, OEM 10:1 -[I] Old - 11.5@125 22psi $90 [U]Stock[/U] 3.0 Junk Motor - 1 bar MAP [/I] 1994 Spirit 3.0T - 11.5@120 20 psi - Daily :eyebrows: Holset He351 -FT600 - 393whp 457ft/lb @18psi 1994 Spirit 3.0T a670 - He341, stock fuel, BEGI. Wife's into kid's project. 1990 Lebaron Coupe 2.2 TI/II non IC, a413 1990 Spirit 3.0 E.S. 41TE -- 1993 Spirit 3.0 E.S. 41TE -- 1994 Duster 3.0 A543 1981 Starlet KP61 Potential driver -- 1981 Starlet KP61 Parts -- 1983 Starlet KP61 Drag 2005 Durango Hemi Limited -- 1998 Dodge 12v 47re. AFC mods, No plate, Mack plug, Boost elbow -- 2011 Dodge 6.7 G56

Page 1 of 7 12345 ... LastLast

Similar Threads

  1. Cool Engineering DRB II from eBay
    By bamman in forum Electrical & Fuel System
    Replies: 2
    Last Post: 06-06-2013, 10:08 AM
  2. willwood engineering
    By overlordsshadow in forum Suspension, Brakes, Wheels, Traction
    Replies: 12
    Last Post: 10-02-2007, 10:18 PM
  3. Stupid Engineering 101...
    By 440trk in forum 3.0L V6 Turbo Engines!
    Replies: 11
    Last Post: 03-21-2006, 04:46 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •