Yes it is out of the case, and what do you mean trace things that aren't there? The port expander? d3irb suggested I look into how it works sending me down that dead end. There is no port expander in this ECU. I assumed from what was said, and info in the link provided that ME7's are all 'dual-core' so I assumed there may be two MCU's in one package.
From what I can see, it's a C167 MCU with 32k mask rom, external 512k flash + 32k sram, the CC650, a LDO power management IC, Injector driver, Discrete coil driver (with phase sensing), H-bridge driver, and a smaller unknown 16pin IC (sc551710mdw) which has its own 4mhz xtal and connects to the CC650. There's a few LM op-amps on the underside for analog stuff, and what I guess is a pair of VR IC's for crank/speed inputs. A very nice, well designed development board for engine management.
The C167's ADC channels are all routed too so I'm not sure how much of the CC650 is being used for ADC.
Do you have any information on the CC650? pinout, register mappings, datasheets?
Right now I'm working on my monitor program to help map out all the I/O to the respective external inputs and outputs, the fault detection signals from the driver IC's and enable signals and anything else that is required to control an engine with my own code. At a bare minimum, if I can read battery voltage, map, tps, iat, clt, detect the teeth from the VR circuit, and control injectors, IAC and coils, I can write some speed density code as a proof of concept
Congratulations with the results. I will add few comments maybe some will find useful.
Looks like ME744 is based on cheapest ME7: ME7.5.10 (schematics available).
16 pin IC is most likely MC68HC05 which works as Ueberwachungsmodul. The Watchdog functions you reverse engineered is described in MED9.1 funtionsrahmen chapter " FUUMKOM11.10.1EGAS¨ Uberwachungskonzept:Frage/Antwort-Kommunikationzw.UMundFR" at 3988p. (in MED9.1 watchdog partner is CY31x)
I guess CC650 also does some VR signal processing. E.g. EDC15P+ does have CC556 and it converts time to angle or other way round.
BTW M38x has similar ueberwachung modul which reside in 68pin PLCC Gate array made by National semicondutors. AN87C196KR has to write correct value at correct time (memory mapped parallel interface) otherwise this chip will increase its counter. If counter reaches 7 it will reset CPU. Correct value at right moment will reset this counter, counter can only be read. MSA15.5(EDC15M) Funktionrahmen describes this.
