Page 1 of 1

What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 2:49 pm
by AndreyB
Why would i just not go down the local car dismantlers and get a ford eecv computer with a power pc cpu with floating point for $40 and put my own code in it?
Does anyone know what's inside the ford eecv? For example, how far or close is this chip to 'SPC563Mx, MPC563x'? I am asking because ChibiOS supports SPC563Mx & MPC563x so if I would be able to get my code into a ford ECU you cannot imagine how happy I would be.

PS: wikipedia has some info but not much

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 3:51 pm
by blundar
There are many generations. Ford has codenames for each of them.

Gas vehicles up to 2004 used a 8096 derivative. (amazing, eh?)

Diesels in 2003 started with a PPC derivative.

Gas vehicles in 2005 started to transition to a PPC derivative.

I'm pretty sure Motorola/Continental was the primary vendor for the PPC stuff. I can try to find out some more but I don't know specifics in terms of processors, etc. off the top of my head. I can probably get some code to look at easily enough... :)

Around 2010, Ford started transitioning to using the Siemens tricore processor in a box provided by Bosch. By 2012, Ford was Bosch/tricore fleet-wide.

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 3:54 pm
by AndreyB
blundar wrote:I'm pretty sure Motorola/Continental was the primary vendor for the PPC stuff.
Visteon Levanta 'Black Oak' PCM is the first ECU that used Freescale PowerPC architecture. The ECU was used in Ford Mondeo,Galaxy, Focus and Ka - 1.8/2.0/2.5/30 Duratec HE/I4 engine.
Did we have this here in the US? They say Freescale so my main question is how close it is to THE PPC ChibiOS runs on.

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:05 pm
by blundar
AFAIK, GM was deep into the MPC56x stuff too... Pretty sure the E67 and E38 ECMs (think: 2006+ V8 car/truck) are MPC based.

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:07 pm
by kb1gtt
There are several OEM re flash options. I'm not sure about that one. Usually it's hard to first re flash, second activate wdt's and such safety devices. If you find some one who has done that you probably could make it work.If not then it will be far to time consuming

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:11 pm
by kb1gtt
If there is programming interest I have a couple DMC Jeep ECU's that are mosty hacked we were half done the doo to get the WDT/Monitor has 5554 inside

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:11 pm
by kb1gtt
Oh also don't forget no reasonable ETPU compiler

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:16 pm
by blundar
ya, I was right...

from wikip: "Delphi Corporation use either the MPC561 or MPC565 in the engine controllers they supply to General Motors, with nearly all 2009 model GM North America vehicles now using an MPC5xx in the engine controller. Bosch also used the MPC5xx throughout the EDC-16 series of Diesel Engine Controllers as did the Cummins B series diesel engine ECU."

Yeah... Ford Spanish Oak are MPC 56x

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:18 pm
by blundar
I have access to flash tools for 96-2014 Ford, GM OE computers. I have raw binary access to most of them. Trust me, reverse engineering this shit is a lot of work -the newer GM E38s use 2Mbyte of flash. The newer Fords use closer to 4Mbyte

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:23 pm
by blundar
On a side note - for a long time, I've wanted to go down this path. (Custom OS for OE ECU) Why? It is growing increasingly difficult to reverse engineer these things. The sheer volume of code and complexity of systems is increasing fast. Eventually, reverse engineering just isn't going to be a viable way to get into OE computers. The burden of RE the hardware (i.e. processor, any custom asics present which are growing fewer and fewer) in order to be able to turn things on and off and decode crank waveforms is FAR less of a burden than doing a full OS disassembly and dissection. This was several projects down the road for me in terms of attention. Eventually, doing a "custom OS" on top of OE hardware is going to be the only way to touch OE computers, IMHO. Especially as the back-door avenues for getting information out of the OEs that the aftermarket tuning companies have relied on slowly starts to dry up...

Re: What chip is inside ford eec*?

Posted: Thu Jan 16, 2014 4:56 pm
by AndreyB
Looks like it would need to be some specific type of (something)PC56(something) - more info

Re: What chip is inside ford eec*?

Posted: Fri Jan 17, 2014 5:19 am
by AndreyB
Siemens MSV70/ MSS70 BMW 3.0i MPC563 AM29BDD160 ST95320 BDM141*
Siemens MSS65 BMW M5 V10 MPC563 x 2 AM29BDD160 x 2 - BDM141* + BDM144*
Siemens SID201 Jaguar/Land Rover 2.7D V6 MPC563 M58BW016 ST95320 BDM141*
Siemens SID202 Ford 1.8TDCI MPC563 M58BW016 ST95320 BDM141*
Siemens SID203 Jaguar 2.7D MPC563 M58BW016 ST95320 BDM141*
Siemens SID204 Land Rover MPC563 M58BW016 ST95320 BDM141*
Siemens SID206 Ford S-Max MPC563 M58BW016 ST95320 BDM141*

Bosch EDC16+ VAG MPC564 M58BW016 ST95320 BDM143
Delphi DCM3.2 MB, Kia, Ssangyong MPC564
eBay has

Code: Select all

Details about  05-06 BMW 325i/525i/E90/MSV70 . ENGINE CONTROL MODULE

Code: Select all

MSV70 $65
Seems like it is mpc563mzp66 inside MSV70.

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 12:55 am
by TheHeckler
The Ford EEC-V runs a chip that is somewhat similar to an 8096 from an instruction perspective that includes substantial analog and time base circuits to support ECU duties.

The family number is 8065 ( 8061 was in EEC-IV ) and they have bank switched RAM/ROM address space for a 256MB logical space although the EEC-V is only typically equipped with a few K of RAM and 192K flash.

There are quite a few special features in the instruction set but no true memory management support.

The EEC-V ECUs up through the last generation in the US had the 8065 although I have seen PPC based EEC-V units in the early 2000s.

Excellent hardware, poor general purpose compiler support but I have successfully run my own modified code ( not just new parameters ) in my race cars.

Inside the EEC-V there are also helper subsystems, most based on an internal serial bus ( like SPI ) although the bulk of the on-board systems are memory mapped.

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 1:13 am
by TheHeckler
If you want a moderately accurate description of the systems in the Ford EEC-IV / EEC-V look for ( google ) documents titled similar to:
  • Technical notes on the EEC-IV
    EECIV Inner Workings
    EEC-EV Pocket Reference
The "holy grail" of docs is a Ford pub titled: EEC ARCHITECTURE AND HARDWARE REFERENCE MANUAL that I have yet to find.

Those are online and fairly decent, only a few inaccuracies regarding the 8065 versus the 8061 in the EEC-IV but it will give you a good basis to consider if you want to delve into coding for the EEC hardware.

FWIW, an assembly language disassembly of a 2001 era EEC-V is 4.5 MB in text, roughly 70,000 lines. 4 banks of 48k each for a total 216k binary that includes roughly 32k of tables and scalar values for the engine parameters.

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 1:27 am
by TheHeckler
The chips were designed by Ford's Microelectronics group in Colorado with support from Motorola and Intel and were cross sourced from several manufacturers.

From the pocket reference "This reference guide is intended for use by engineers and programmers who design, develop, and program 8061 and 8065 microprocessor-based systems. It contains basic hardware and software information summarized from the following references: EEC-IV 806X Family Custom ICs Architecture and Hardware Reference Manual, EEC-IV Software Manual, EEC-IV Strategy Development Support System User's Guide; EEC-IV Calibration Development Support System User's Guide, 8061/8063 Cross-Assembler User's Guide, and the Target Specifications on the individual devices within the EEC-IV family of custom integrated circuits (ICs)."

Special chips and logical units in these include the following devices:
Serial control protocol chip ( SCP ) handles external J1850 communications and flashing
The AICE is the analog conditioner chip. It includes a serial interface module, the analog signal conditioning and scaling sections, misfire detection, pip conditioning, EDIS diagnostic monitor and CID conditioning along with general purpose AD inputs. The AICE converts the MAF, HEGO1 and HEGO2 values on every PIP signal and places those values in special registers. All other conversions land in the on demand register. 14 channels
Analog or digital electronic distributor (EDIS)
The DARC-I/O LSI provides the following, each of which is described in a
section to follow:
o 6 configurable parallel bidirectional digital I/Os (PI/O)
o 12 configurable multiplexed parallel bidirectional digital I/Os (MPI/O)
o 8 programmable pulse-width modulated outputs (with configurable HLOS
states) (PWM)
o 6 Delta-Time capture Inputs (DTI)
The DARC also provides a Serial Peripheral Interface (SPI) port for
communication of commanded output states and output fault data between the
DARC and EEC-V module power output driver devices.
The DARC chip provides a memory-mapped six-channel bidirectional parallel I/O
port. Each I/O channel can be programmed to serve as either an input or an
output. The inputs are filtered for noise rejection, and may be inverted
prior to filtering.
Inductive signature sensing
Injector and ignition drivers

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 1:33 am
by AndreyB
@ what does the community know about PowerPC chips? The ones which are shared between Freescale and ST would be of the most interest - these ones are relatively modern and with ST sponsoring ChibiOS there is a chance to find one which would be shared within the Freescale/ST alliance.

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 3:16 pm
by TheHeckler
@russian I am not very familiar with the PPC variants. I'd open up my one PPC based eec-V for a look but Ford likes to put random part numbers on things instead of industry PNs.

Re: What chip is inside ford eec*?

Posted: Sat Jan 18, 2014 10:14 pm
by blundar
AFAIK, the progression from EECV to Oak/PPC:
2003: 6L diesel
2004: ETC Trucks
2005: ETC Gas cars i.e. mustang

Basically, as the vehicles went DBW/ETC they went to PPC.

Then around 2010, some the F150 started moving to Tricore. GT500 in 2010. Mustang with new 5L in 2011. Diesel with 6.7L powerstroke.

Re: What chip is inside ford eec*?

Posted: Mon Sep 30, 2019 5:31 pm
by Dunebuster
I was in the Electronics division engine engine control development group and wrote the "skunk works news" among other things between 1978 and 1988. The EEC-IV hardware and software manuals, programmers reference card were done by my instigation and I over saw an external supplier doing the work over several years. The reference card was developed from my experience in IBM 360 and 6502 assembly language and their respective reference cards.

EEC was essentially a sequence of different early microprocessor architectures.

EEC-I and EEC-2 were supplied by Toshiba who also supplied an 8 Bit micro. EEC-I did Spark and EGR control, EEC-II added FBC (Feedback Carburetor control) they were in production from 78 to 79 all for lincoln.

In 1980, EEC introduced EEC-III. EEC had 2 versions FBC and CFI (CFI sold on 5.0L Lincoln only (I believe) EEC-II used a Motorola 67002 12 Bit nano computer and used 10 Bit data words (no low byte, hi byte organization) it ran thru 1983 in limited use.

EEC-IV started initially as a Vane Air Port injected engine controller for 1983 Escort/Lynx, EXP and LN7 family) it ran great I owned a brown LN7 2 door fastback and you had to barely hit crank and it would start.
Ford contracted with INtel to design and build the 8061 microprocessor for EEC-IV. it was the first Microprocessor to have a process that allowed both digital controller and A/D converter on chip. to keep infrastructure down there was a bi-directional BUS and 3 bit control lines that allowed the architecture a 16 Bit address space. Page 0 (addresses 0000 thru 00FF were internal I/O and data registers)
external ROM was the 8361 with 8k ROM and 256 byte RAM. initial production used 2 ROMs so there was 16K ROM and 512 bytes RAM in addition to the 240 Bytes of internal RAM registers (all Pg 0 RAM was accessible as registers, i.e. AD3B Ra,Rb,Rc added contents of Reg A to Reg B and put it in Reg C. Math was byte, word and shifts, divide used a 32 bit value.
The 8061 had 10 10B A/D, 10 bits input and 10 bits output and 2 bidirectional I/O for flexability.
A second gen Memory program netted 16 and 32K MROMs and EEPROMs, a 2K RAM-I/O and a version with a Time Triggered message controller that if patented would have made problems for later TIme Triggered Protocol patents.
The 8063/65 was due to the 8061 NMOS process to not yield 15MHZ speeds and we needed the faster processing, and Intel advising that the 8061 NMOS process was going to be abandoned and they did not want to re-design in CMOS. Ford had started a joint facility with Ford Aerospace to design GAAS chips and support IC testing for Ford Automotive so they added the 8013/65 to their list and a team from Dearborn worked with FMI to architect improvements. We had many great improvements: 1Meg address space (16 pages of 654k), 64 inputs and outputs, 32 interrupts, 16 A/D's
on decision to add 2 layer metal was a significant change as first silicon yielded at 45MHz and later systems got to 200MHZ with shrinks.
I later found the 8065 lasted in production to 2007 so one IC software family stayed in production from 83 to 07 - 24 years, that's forever.
Both the 8061 and 8065 had and early I/O processor, we called it the High Speed I/O processor essentially a mechanism to capture an input transition and the time it occurred into a 12 deep carousel, and 16 deep on the 8065. this made accurate spark more controllable and with transition interrupts jumping to interrupt service events and timer interrupts made spark and fuel control stand alone processes that reduced real time processor loading.
Great days I got to use both my Digital circuit design skills and software coding skills to make a great processor.

Two more notes: 1) Intel derived the 8096 from the 8061 by hanging an Intel bus off it for commercial use, and later re-scaled the instruction set 2 and 3 operand math, added look ahead score boarding to create the 80196 processor that never got off the ground. too bad. 2) I called the family a CRISP family of processors not a RISC or CISC chip, as the 8061 had a plethora of internal registers that made it an excellent RR to RR instruction set but also had with the 3 Byte, 3 word operands and Index+Displacement register, register indirect, register indirect auto increment a great and fast math machine for tables which was important with FOX and FOXY lookup table driven software.

One final note: during the 8061's gestation in 1981, I was at SC4 early in the evening with Dick Umstedet the ALU designer, testing chips to fly home with the next day and in walked the new manager who went to dinner with us at Taco Bell, the manager's name: Craig Barrett later Intel CEO (1998-2005)

I moved on to better things as in the 90's Ford switched over to the POWER PC family.

Re: What chip is inside ford eec*?

Posted: Tue Oct 01, 2019 1:52 am
by AndreyB
Dunebuster wrote:
Mon Sep 30, 2019 5:31 pm
I was in the Electronics division engine engine control development group and wrote the "skunk works news" among other things between 1978 and 1988.
Thank you, very interesting info here!

Are you still in Michigan? I am in Ann Arbor until Friday :)

Re: What chip is inside ford eec*?

Posted: Sun Oct 27, 2019 9:02 pm
by 960
All MPC56 MCU's are basically the same I think, MCP561 and MCP563 even share referance manual.

The ECU you should go for are the Bosch MED9 (GDI), who use a MCP561.

That's the one you will find (already have) most documentation for, regarding both the mcu, but also the rest of IC's.