3P's TCCS Disassembly/Analysis

nuttom

New Member
Authorized Seller
Joined
Jun 29, 2014
Messages
11
Likes
0
Location
SIGOLSHEIM, FRANCE
Oups, made a mistake with DENSO P/N and DIE observation

The main MCU, supposed to be an Hitachi 8x labelled as follow (from a Toyota MR2):
D151802-4800
7433-1380
1B2524



The second MCU dedicated fro knock and lambda sensor:
D 151802-2860
572 130M
9046 Z44

Here is the logo:


Here is the complete manufacturer's name and maybe the year:


The partnumber !


And a random marking, maybe the mask version:


Sorry for the dirt on the DIE !
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
Great job! Looks like it's an enhanced 4-bit serie of Fujitsu MCUs. It has ADC, timers, USART.
The following pinout seems to be similar with sDIP42 D151803-4151 (knock-DSP from 1G-FE ECU).
Xin,Xout, power lines match. ADC power lines are different. Need more investigations.
mb88517.jpg
 
Last edited:

nuttom

New Member
Authorized Seller
Joined
Jun 29, 2014
Messages
11
Likes
0
Location
SIGOLSHEIM, FRANCE
Off course I contacted Fujitsu but they told me they sold the Mcu division who is now hold by Cypress, but cypress couldn't help me because it's too old and also made under fujitsu management...
 

3p141592654

90T
Authorized Seller
Contributor
Joined
Oct 11, 2005
Messages
4,040
Likes
50
Location
Thousand Oaks, CA
Nice! I think the S G S are pad labels (G is usually used for ground). Looks like a wafer probable test port or process control monitor to me. Thank for confirming that the knock sensor is a Fujitsu part.
 

JonS

New Member
Authorized Seller
Joined
Apr 9, 2009
Messages
25
Likes
0
Location
Cambridge
If someone could provide an IC (even broken) I will be so happy ! There is a hope to find the exact partnumber !
I've got a MR2 ECU that's been scavenged for various parts, if I can find it I can send you the knock IC.
Unfortunately it looks like I binned the PCB. I do have a knock sensor IC from a dead 3VZ-FE ECU, the IC part number is D151802-8860. I also have a faulty main MCU from a later MR2 ECU, part number D151803-9651 if you'd like to look at that as well.
 

nuttom

New Member
Authorized Seller
Joined
Jun 29, 2014
Messages
11
Likes
0
Location
SIGOLSHEIM, FRANCE
Ideally the main chip so I can try to find the exact partnumber, logo, manufacturer anything to confirm the identity of the chip.

But any chip is welcome and especially all masked rom, like the knock chip, because bits are hardwired on the silicium and can easily be read by a software analysing pictures, the firmware can be dumped by automated visual process.
 

kimdrummel

New Member
Authorized Seller
Joined
Oct 10, 2015
Messages
2
Likes
0
Location
Eastbay
Ok, so just have to ask real quick. Pardon me for not reading all 700+ posts.

Is there any info or any progress being made on the 3S-GE engine's ECU? That is the NA engine in the Celica ST165 and ST185.

The Ecu's got the DIP40 packaged CPU, and i've always wanted to dump the content of the rom and make a daughterboard with external DIP28 27C256 that will allow me to use the Ostrich 2.0 emulator and tune the software for wilder cams etc.

Is there a known way of doing this? Is it similar to what you have been doing? Cuz i take it that this only concerns supra ECU's?
 

JonS

New Member
Authorized Seller
Joined
Apr 9, 2009
Messages
25
Likes
0
Location
Cambridge
Is there any info or any progress being made on the 3S-GE engine's ECU? That is the NA engine in the Celica ST165 and ST185.

The Ecu's got the DIP40 packaged CPU, and i've always wanted to dump the content of the rom and make a daughterboard with external DIP28 27C256 that will allow me to use the Ostrich 2.0 emulator and tune the software for wilder cams etc.
DIP40? The photos I've seen show a DIP42 package. Post 686 on this thread has a photo of a ROM reader board which can read DIP42 CPUs.
 

kimdrummel

New Member
Authorized Seller
Joined
Oct 10, 2015
Messages
2
Likes
0
Location
Eastbay
DIP40? The photos I've seen show a DIP42 package. Post 686 on this thread has a photo of a ROM reader board which can read DIP42 CPUs.
Yeah sorry, DIP42. I didn't quite remember.

Are there any memory dumps available from a 3S-GE DIP42 CPU?
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
I'm currently working on a daughterboard for a "lesser brother" of sDIP64/PLCC68 D8X, namely D8X-42 (DIP42/PLCC44). I decided to use ATMega128A instead of CPLD and some SRAM to use ROM emulators/upload firmware from ATMega.
I got a simple question on the IRP signal functionality. In ancient 3Y-EU ECU (MC6801-based) IGF signal was examined by a special register, responsible for handshake protocol. A rising-edge signal on a special pin sets bit in a register. Until MCU reads this register, that bit stays active. If IGF won't come, the bit would not be set and MCU reports an error code.

A more advanced D8X-42-based 3Y-EU ECU has IGF signal wired to, presumably, IRP (or IRL?) signal that probably have similar function. But, in case of D8X-42, it triggers latch of PORTA data into PORTAL, right?
 

nuttom

New Member
Authorized Seller
Joined
Jun 29, 2014
Messages
11
Likes
0
Location
SIGOLSHEIM, FRANCE
From my point of view there is 2 possibilities:

1: Extracting the stock firmware for deep analysis (decompiling, binary->assembly language->any high-level language like C->state-machine graph), I made a couple of reverse engineering on competitor's products (when working for automotive industry) like smart electronic actuator (manifold actuator, water valve, active air box etc...) and also on my personal ECU (Nissan P10 and Nissan P11GT) but never the whole ECU but just a part (anti-theft, diagnosis protocol, etc...).

Once done the control law is ported to a new and modern architecture, but the job must be done for each firmware !

2: Duplicating the MCU logic to a FPGA for example, but coupled with modern flash memory or nvsram for real-time (on-the-fly) modification. MCU are so simple and basic that this could be possible to do on a "small" low-power FPGA. The now called soft-MCU will run the stock firmware and take place in stock ECU keeping the all signals conditionner and actuators driver.

But in both case a datasheet is necessary and this is where it suck so hard !
I prefer the second because the hard job is done once and then compatible for almost all ECU !
 

Nick M

Established 1994
Authorized Seller
Contributor
Joined
Sep 9, 2005
Messages
8,810
Likes
10
Location
U.S.
Deleted

Not needed having read through the thread.
 
Last edited:

Jeff Lange

Administrator
Staff member
Administrator
Authorized Seller
Joined
Mar 29, 2005
Messages
4,989
Likes
13
Location
Edmonton, Canada
I skimmed through a lot of this thread as well as reading many posts more closely, there was some talk of 1JZ ECU's, has any testing/development been done on the JZA70 ECU at all?

Jeff
 

Nick M

Established 1994
Authorized Seller
Contributor
Joined
Sep 9, 2005
Messages
8,810
Likes
10
Location
U.S.
I have read the whole thread now. Good to know there is a solid answer with the Lex meter. Although my car runs and idles very well.
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
e43d931s-960.jpg

JZX100 ECU test. 3 boards running 68pin denso MCUs from external RAM. 540cc injectors from Toyota Caldina. No MAF. Engine tends to stall.

[video=youtube;CQ-52Rz9w2c]https://www.youtube.com/watch?v=CQ-52Rz9w2c&feature=youtu.be[/video]
 
Last edited:

Nick M

Established 1994
Authorized Seller
Contributor
Joined
Sep 9, 2005
Messages
8,810
Likes
10
Location
U.S.
When you get around to it...how hard would it be to switch from 550cc injectors to 680 or larger? After you produce the modified PCM.
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
There's a "magic" constant exist in the code. Works similar to the "req fuel" constant in mega$quirt.
JZX90, 1JZ-GTE, MAP-based, also has this constant and could be tuned up to 850cc injectors. Maybe even more.
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
7M-GTE code (gray connectors) for IDA with some comments
https://yadi.sk/d/JLxfDOfH3LeLvZ
I'm currently working on the replacement of a Karmann vortex type AFM with a "hot-wire" one from JZX100.
Also, I'm planning to replace altimeter MAP with a MPXH6400. It is strange that internal altimeter MAP has such a priority along with other ADC channels. Although the altimeter MAP has lots of pins, only three of them are actually used.

9f14299s-960.jpg
 

mentat-vvo

New Member
Authorized Seller
Joined
Dec 23, 2013
Messages
19
Likes
0
Location
Vladivostok
I've made experimental ECU with stock AFM, equipped with my external memory module + upgrade of the MCU (7433->5B25CT-1, which has +100 bytes of RAM).
Changes that were made:
1) Stock barometer MAP became external; can be easily replaced by an MPXH6400 (20kPa - 400 kPa)
2) A communication port with a bluetooth module / USB-RS232TTL for comms/firmware upgrade was attached
3) 5-pin connector was attached for an external hot-wire AFM (5 signals: +B, VG, THA, E2, EVG); ADC6 was used for this through 47nF/2k7 RC-filter

Stock code will be modified so that I will be able to record logs for MAP/hot-wire AFM to replace karmann vortex AFM either to a hot-wire type or to MAP.

IMG_5548.jpg
 
Last edited:

Piratetip

Far From Maddening Crowds
Staff member
Super Moderator
Authorized Seller
Joined
Dec 30, 2005
Messages
1,419
Likes
56
Location
MKE, WI
^ Agreed

Any options available for an 87' 7M-GTE M/T ECU?

Pi, do you have any boards made up yet?
 

Rollus

Member
Authorized Seller
Joined
Jun 2, 2011
Messages
593
Likes
2
Location
Paris, France
I guess it's not dead.

I know beta testers (I'm one of them) are not as acive as before. Personaly I've spun a bearing and no time/money/bravoure to repair yet.