Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: help - MH7203FA


Veteran Member

Status: Offline
Posts: 80
Date:
help - MH7203FA


Hi, I've started tearing down an ECU from an SV650 and the CP is not the same as the chip in the ECU off the thousand ... wondering if anyone can help identifying it? ...

The main markings on the chip are:
[Mitsubishi logo] MH7203FA

Any hints as to what it is and/or datasheet appreciated.

I think it might be a custom masked renesas chip?

It has 4x28 pins. I haven't yet removed enough potting to trace any of the pins yet though.

Cheers,
MarkW

__________________


Guru

Status: Offline
Posts: 964
Date:

From what I could find out it is supposedly an Hitachi H8/539F

http://www.datasheetarchive.com/pdf/1520357.pdf

The chip package is the same size but I can't swear its the same item. I would compare the crystal, Vss, Vcc pins to the pinout in the datasheet.

It is flashed via the serial port but I didn't see any kind of AUD or JTAG port. Not sure how you would read the code out of it other than load some kind of RAM routine to do it for you.

Have fun with that hmm



-- Edited by RidgeRacer at 20:02, 2008-01-22

__________________


Veteran Member

Status: Offline
Posts: 80
Date:

Yes. The Vcc, Vss, xtal connections align perfectly with the H8/539F.

No back doors on this chip, so will have to write some code, boot it in bootmode, etc to read it and write to it (assuming that the mode can be toggled via pins on the harness connector).

On the plus side, this process could be used for the 7052 ECUs, eliminating the need to notch the ECU.

Cheers,
Mark.

__________________


Veteran Member

Status: Offline
Posts: 73
Date:


Hi Mark,

I can for sure help you...

If you want send me the ecu, I will read it for you and send it back to you.

And of course send the stock dump ....

I can't share my own work on the kernel I develop for that MCU.

But I will be happy to help read it out the stock dump and add it to the ecus I read out.

Let me know if you are interested...

Regards


Christian Piasini

__________________
Christian Piasini


Veteran Member

Status: Offline
Posts: 80
Date:

Hi Christian, that is generous of you.

How do you plan to read the code out of the chip? As far as I can tell so far, serial port 1 (Tx1/Rx1) isn't directly connected to any of the pins on the connector to the wiring loom. And the connection to MD0 and RST is via a network of components to one pin on the loom connector, ... and so on.

In order to be useful, you'd need to be able to pull the code out via the main connector to the loom. That's what I'm working on at the moment. I haven't developed any kernel (yet) but am keen to give it a go.

Is there any reason you are unable to share your work?

I need a couple more weeks to trace the hardware in the ECU, and if I make no progress or hit dead ends then I might let you have a go at it. But unless there's a way to reprogram it without having to open up the ECU, there's very little benefit it obtaining the code (other than to satisfy my curiosity).

Cheers,
Mark.

__________________


Veteran Member

Status: Offline
Posts: 73
Date:

Hi Mark,

I can't share my own work because I develop tools to read/write ecus of cars, and from March I will release a complete new device and it handle Suzuki and Yamaha for sure. SH70xx MCU and all the MHxxxx mcu.

I already success read the R1 2003 ecu (MH7002F) and the R6 2004 ecu(MH7003F), no need open it, i just plug 4 pins on the ecu plug and i read/write it.

but the kernel is my own.

If you need help, I will be happy to help until i can, of course..

Regards

Christian Piasini

__________________
Christian Piasini


Guru

Status: Offline
Posts: 2338
Date:

Looking forward to get one for reverse engineering it just like we are doing the ecus here on this board. I am sure that many of the ideas have been presented here on this board or some other ecu related boards already so that there is no copyright issues in publicly reverse engineering it smile.gif.

For those who are interested, Colby has promised to look into writing his kernel for the open source project for the sh7052 ecu we can provide to him. So that should be avail as part of the openecu community soon too ...

Are we going to see a race who will be first there, the commercial Italian or the US/Australian open source approach ?

I am also curious what protocol is to be used as the OBD is not supported, CAN is not connected on these ECUs and the TX3/TECH does not return other than ram area. RX/TX1 we already covered on other thread that for H8xxx processors it can be used but SH7052 is so old that it always erases first. So its going to be interesting - indeed smile.gif) ... MEC / KEFICO ...

EDIT - But I must admit I like the global approach of Piasini Engineering:
http://www.youtube.com/watch?v=9eEawCsjdmQ


-- Edited by PetriK at 18:21, 2008-01-29

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 80
Date:

Hi Christian, I appreciate the sensitivity of your work - thanks for that. I assume that on the R6, the Tx1 and Rx1 pins of the processor are accessible via the main loom connector? - or are you gaining access via a secondary socket that the dealers use? Also, are you using an undocumented pin at the loom connector to reset the ECU and throw it into a different operating mode?

That's the path I'm following at the moment with the SV650's ECU.

Cheers,
Mark.

__________________


Veteran Member

Status: Offline
Posts: 73
Date:
For Petrik


Hi Petrik,


You can search on openecu forum my name.... to see something about me and my work and hobby...

I don't be there to make race with the USA open surce forum.....but if you give a look....we can do cars Mitsubishi that' colbes can't and also ECUtek....

That's just to tell, we aren't the last wheel of the whole engineers arround the world..... smile.gif

And about the SH70xx MCU, our device full support the 7052/7054/7055/7058/MR32 MCU smile.gif

I'm here in this forum because it is also my hobby and I want let the others know what I'm doing...

Regards

Christian Piasini


__________________
Christian Piasini


Veteran Member

Status: Offline
Posts: 73
Date:
RE: help - MH7203FA


RE: help - MH7203FA

Hi Christian, I appreciate the sensitivity of your work - thanks for that. I assume that on the R6, the Tx1 and Rx1 pins of the processor are accessible via the main loom connector? - or are you gaining access via a secondary socket that the dealers use? Also, are you using an undocumented pin at the loom connector to reset the ECU and throw it into a different operating mode?

That's the path I'm following at the moment with the SV650's ECU.

Cheers,
Mark.


The R6 has differents pin then R1 on the ecu plug.
 
I realy don't know if the dealer can connect on the loom, I have just the datasheet manual and I don't have find out point for connection to testers/scanners.
And on the mauals I find out, the dashbord can use like scanner for check the faults and see the value of each sensor on the engine, and have a list of fault code for each thing.

regards

Christian Piasini


__________________
Christian Piasini


Guru

Status: Offline
Posts: 2338
Date:

christian_piasini wrote:

Hi Petrik,


You can search on openecu forum my name.... to see something about me and my work and hobby...

I don't be there to make race with the USA open surce forum.....but if you give a look....we can do cars Mitsubishi that' colbes can't and also ECUtek....

That's just to tell, we aren't the last wheel of the whole engineers arround the world..... smile.gif

And about the SH70xx MCU, our device full support the 7052/7054/7055/7058/MR32 MCU smile.gif

I'm here in this forum because it is also my hobby and I want let the others know what I'm doing...

Regards

Christian Piasini



It would be great to have better flashing tools also for motorcycles and therefore I would like to challenge you to prove that your company can deliver what you promise here. There is a lot of words but very few who can deliver, I still remember the story of Superchips from early '90s. At the end modifying the TPS and Air Pressure signals with a simple piggyback computer would have yielded better results than those.

Also OBD tuning is easy, an ecu that is not supporting OBD is as you know is much more difficult. In Mitsubishis and many other cars there is an embedded user mode kernel that has a authentication, after that is known then rest is easy smile.gif .

In Busa sh7052 the SCI1 & SCI2 interrupts are not connected anywhere and SCI3 subroutines are programmed to read only RAM area variables. HCAN interrupt is not connected to anywhere either.

... anxiously looking forward to see proof of concept from Piasini engineering !




__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom

Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard