My Aveo ECU hacking journey has begun

[06T200]

Link to the free toolchain: Free TriCore™ Entry Tool Chain - Activation & Download

Be sure and use google if you are curious, Infineon is quite proud of this chip line and shares a lot of detail about it.
Enjoy!

[xintersecty]

FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

For some background: Operating Systems - Infineon Technologies

Years ago at IBM I worked on system management systems using H8s. Good chip. I read up on the tri core:
https://en.wikipedia.org/wiki/Infineon_TriCore

So what is your goal in getting inside the MCU, more power? Better efficiency? I find it interesting that they are using DSP tech (not surprised either) and I get that is for getting good data on the o2 sensors, timing, and figure the spark quality.

[06T200]

Years ago at IBM I worked on system management systems using H8s. Good chip. I read up on the tri core:
https://en.wikipedia.org/wiki/Infineon_TriCore

So what is your goal in getting inside the MCU, more power? Better efficiency? I find it interesting that they are using DSP tech (not surprised either) and I get that is for getting good data on the o2 sensors, timing, and figure the spark quality.

Very cool! At some point your skills may be able to steer some ideas.

Actually - to be honest, no real goal with this one, (which makes it fun in itself!) just exploring the space ‘in the box’.

My crazy idea, was to gather the bits on the operating software/mcal, and just have a look. The table locations/formulas’ would be some peripheral bennies from the work, especially for anyone wanting to change them, knowing table locations, etc, and just for lack of better words WTF is this thing doing? Lol

So I discovered I can’t just throw a ‘roll-my-own’ boot loader on without the secret squirrel magic ‘signature’ that is in the Delphi chip, we will call this the ‘EMS COP’ chip. With the ‘bounds checking’ not much I can do over the K-line/CAN. Kinda sucks!

Just knowing what the cpu/mcu/dsp is capable of has been a help in not wasting tons of time. So I will need to pull the amd flash chip, and use a reader (these are available im told) to pull the data off it, and just grab the whole 8MB contents. Then process the data/reflection. I have some help from another forum much more advanced than myself, im just a nerd mechanic - I turn the screw driver, and write code

I’ve been more curious at the possibility of just using an open source RTOS/OSEK system on it, (using most of the same standards, ie. AUTOSAR/OSEK and other so-called ‘open standards’ (with closed source!) in much the same way the oem market does, but would be for off-road application/tuning. Only a matter of time before they all (even aftermarket) land on the same page via the standards, and I see a few open source rtos/EMS systems now ported to the tricore architecture.

Who knows, but this is the sum of the experiment. I see the movement to open source engine management, so im just using what I have available to help explore that area. I know the OEM’s don’t always follow the standards, but so far everything seems to line up on these first gen boxes anyway.

I don’t think I would be sharp enough to be able to gut out all of the ‘bounds checking’ and 'security' code in the stock ecu sw, so the ‘trend’ seems to be looking at porting open source software onto the various ECM chips/mcu’s. And since we have a very well designed and quite popular 'TriCore Aurix' platform (mainly in Bosch/Motec boxes) why not explore?

To summarize the concept, use open source engine management - on existing MCU/EMS box, and just turn on/off what you need in the software. Mapping tables, lut's etc. is a different art IMO and is done manually on a dyno cell/rollers by trial and error. This stuff is just computer 101 box programming stuff, then running something well known and proven in what was a stock 'regulated' box, repurposed for custom/off road/racing duty, not engine, or car specific.

[06T200]

ooops!! Sorry to write a book, but I have been busy... - I may be over simplifying the EMS aspect of the dsp - but far as I know it is just timed interrupts that respond to the sensors, so it is simple logic, that is lightning fast in practice. In theory it is complicated, but all the logic is in EMS libraries that are pretty open now. Time will tell! It's only a side project, I may hit a wall at any second and shelve the whole thing lol

[06T200]

In case anyone wants to dive in deep to the Infineon TriCore chip.

http://www.infineon.com/dgdl/TC1_3_A...12be86204c0111

These chips are most well known to be found in Audi/VW Bosch Motec ECU's from the late 90's to current models. Our box is made by Delphi in Korea, by what look like to be former Hitachi/Robert Bosch employee's. I still need to confirm that the 04/05 uses the same platform.

[06T200]

One of the more stable OS's ported to TriCore chips.

https://en.wikipedia.org/wiki/ERIKA_Enterprise

http://www.evidence.eu.com/download/...rprise_1_6.pdf

[06T200]

More info,

Media blurb about Delphi/Infineon collaboration...
Infineon Technologies Announces Design Win; Delphi Automotive Systems Selects Award-Winning 32-bit Automotive Controller ICs - Infineon Technologies

" Delphi, a world leader in mobile electronics, transportation components and systems technology, selected the Infineon TC1775 engine management controller for a new system design"

TC1775 Datasheet
https://www.dropbox.com/s/iuvfepwbxr..._0502.pdf?dl=0

TC1775 User's Manual
https://www.dropbox.com/s/au6sgdgojj...anual.pdf?dl=0

[06T200]

More info on the TC1775

Ignition Algorithm/app notes document
https://www.dropbox.com/s/19gnj1n98l...23610.pdf?dl=0

Injection Algorithm/app notes docuement
https://www.dropbox.com/s/squt87oj9h...23710.pdf?dl=0

Link to the IAN (interactive application notes) and example source code for the above ignition and injection algorithms as implemented in the TC1775
http://www.infineon.com/dgdl/TC1775_...1344b7a5cf02e8

[djmarch]

Interesting stuff

[jamesd]

Pretty cool stuff! I did some Assembly programing back in my college years.