I have looked at the board, and there is a smaller second ASIC labeled '30380'. This is said to contain the Knock IC and additional ADC channels. This is somewhat confirmed by Bosch's application pdf that says pretty much that. I suppose a quick IO test on one of the ports will confirm if there is a second MCU or not in the same die.
I've been looking through the firmware and I have found this small function:
seg009:00001B26 sub_81B26: seg009:00001B26 bset P4_7 seg009:00001B28 bset DP4_7 seg009:00001B2A nop seg009:00001B2C bset P3_8 seg009:00001B2E bclr DP3_8 seg009:00001B30 extr #1 seg009:00001B32 bset ODP3_8 seg009:00001B34 bset P3_9 seg009:00001B36 bset DP3_9 seg009:00001B38 extr #1 seg009:00001B3A bclr ODP3_9 seg009:00001B3C bset P3_13 seg009:00001B3E bset DP3_13 seg009:00001B40 extr #1 seg009:00001B42 bclr ODP3_13 seg009:00001B44 rets seg009:00001B44 ; End of function sub_81B26 seg009:00001B44
Which is setting up port direction and state, and right after this function we are setting up SSCCON, and the following function:
seg009:00001C6C SSC_func4_PEC_dualcore?_: ; CODE XREF: sub_81C64↑j seg009:00001C6C mov r4, #200h seg009:00001C70 or r4, r12 seg009:00001C72 mov PECC4, r4 seg009:00001C76 mov r4, r13 seg009:00001C78 mov r5, r4 seg009:00001C7A shr r5, #14 seg009:00001C7C shl r5, #1 seg009:00001C7E mov r5, [r5+0FE00h] seg009:00001C82 bmov r4.14, r5.0 seg009:00001C86 bmov r4.15, r5.1 seg009:00001C8A shr r5, #2 seg009:00001C8C mov r14, r4 seg009:00001C8E mov word_FCF2, r14 seg009:00001C92 mov r4, #0F0B2h seg009:00001C96 mov word_FCF0, r4 seg009:00001C9A mov r4, #400h seg009:00001C9E or r4, r12 seg009:00001CA0 mov PECC0, r4 seg009:00001CA4 mov r4, #0F0B0h seg009:00001CA8 mov word_FCE2, r4 seg009:00001CAC mov word_FCE0, r14 seg009:00001CB0 and SSCCON, #0F0FFh seg009:00001CB4 bclr SSCEIR seg009:00001CB6 mov SSCRIC, #7Ch ; '|' seg009:00001CBA mov SSCTIC, #0F8h seg009:00001CBE mov r4, #1 seg009:00001CC0 rets seg009:00001CC0 ; End of function sub_81C64
Which suggests the communication channel is similar as the dual core link you referenced earlier, PECC0 and PECC4 being used for SSC transfer direct to XRAM. I'll double check which port the EEPROM /CS is tied to be sure this isn't just an eeprom data handler function and is related to the Port Expander. I think we're getting somewhere.
|