Command buttons connected to MAC7116 MPU in preFL Convers+

[Go4IT]

Hey guys, this is something for the electronic technicans here!

I started this thread to find and discuss what it connected to which pin of the MAC7116 processing unit in order to find and name the functions of the firmware using it. The background is that each IO port is driven by software. Therefore the firmware reads or writes signals (digital/analog) on this ports using memory locations (this is called "memory mapped IO"). So if we identify a signal on the mainboard going to pin and from the pinout of the chip know what memory location(s) this pin is using, we may find the routine handling those pin.

mac7116_pinout.png

For example:

The steering wheel up/down/left/right keys are analog coded using a resistor-ladder, so every key pressed causes a different electric resistance, which results in a different voltage (https://mk4-wiki.denkdose.de/en/artikel ... _schematic). Thus is fed through pin 30 of the IPC plug (the "OK" key has a separate input): https://mk4-wiki.denkdose.de/en/artikel ... pc_stecker and then goes more or less directly to one of the A/D converters of the MAC7116 (there will be for shure some protection parts inbetween the MCU pin and the plug pin. So it could not simply be measured with an multimeter). The MPU can now "detect" which key is pressed by reading the digital value of the voltage applied.

I followed the routes on the pcb from PIN 30 (resistor ladder signal) to some parts on the back of the pcb, which forms the input protection circuit (overvoltage, ESD protection, reverse polarity, etc.):

btns_pin30_inputprotection.jpg

The "clean" signal is availabe on an TP (test point) on the top of the PCB:

btns_pin30_tp.jpg

and goes directly to pin 105 of the MAC:

mac7116_pins.jpg

This pin is labled "PE6" which is part of the portgroup "Port E". This portgroup is connected to the analog-to-digital converter A called "ATD A" where the signal is called "AN6_A":

mac7116_block.jpg

By the datasheet i found that the memory IO address if this portgroup is:
"0xFC0E 0000 – 0xFC0E 3FFF Analog-to-Digital Converter A (ATD_A) Table C-18"

There is one 16-bit "result register" (offset 0x0016, so absolute address would be 0xFC0E 0016) which carries the value read:

mac7116_atd-result-register.jpg

Now it's up to understand how it works. It seems that the A/D conversion must be triggered, then a flag shows if it's finished and it can then be read by the software from that register. This is what the datasheet tells about:
"This read-only register contains the result for the last conversion that has been executed. After a conversion, the ATD will assert a DMA request to transfer the result to on-chip or external memory. Alternatively, the result can be read by the processor. When the processor reads the result, the DMA
request (for saving the result in the memory) will be de-asserted. After either the processor or the eDMA has read the result, a new result can be stored in the result register. If a result has not been read by the processor or eDMA before a new conversion result needs to be saved, a result loss will occur; the new conversion result will overwrite the previous result and the CRL (conversion result loss) bit in the flag register (ATDFLAG) will be set to ‘1’. Following the result loss, the ATD will continue executing conversions."

[DGAlexandru]

We should do this HW "disassembly" in different topics for FaceLift and for PreFaceLift Convers+ as they have hardware difference between them which might get us in trouble if we write the finding in the same thread.
If we manage to discover all of them then it might be feasible to port the entire Firmware of FaceLift to PreFaceLift and then add back the corresponding functions that control the temperature and fuel gauges

[Go4IT]

Agreed, i changed the subject accordingly.
Before reaching out to the stars we should do good old groundwork