[G0HZU_JMR]

Way back in around 2002 I reverse engineered a load of car ECUs that use the 680x MCU. If you dump out the ROM code from the MCU I can have a look through the program if that helps?

I'm older and slower these days but I can probably still read this code quite well. Back in 2002 -2008 I was able to reverse engineer quite a few ECUs and worked out how each car managed its fuel and ignition, how it dealt with knock sensors and how it used sensor inputs to access various maps. I also reverse engineered the ECU housekeeping. Also found a few easter eggs in the code including a hidden diagnostic interface.

From what I can remember of a typical ECU system, the MCU program ROM code (written by the ECU manufacturer) jumps to the reset vector, then their program code in ROM sets up the stack and the ports and some interrupts then it does some housekeeping to check its internal RAM with a very quick read write of most of the RAM. It then does a rapid ROM checksum.

But during runtime it sets a watchdog timeout. I can't remember the exact details but I think it used an external timer that had to be reset by the MCU chip if it is healthy. If this didn't happen then the external hardware assumed the MCU was in a crash state and it sent a reset pulse to the MCU chip.

If it failed the ROM checksum the MCU deliberately ran itself into an endless loop waiting for the hardware to reset the MCU so it could try again... and again and again...

So maybe your system has this type of watchdog reset? Can you dump out the ROM code from the MCU? Note that I've not played with the MC6802 but I have played with MC6801 and the EPROM window version.