Recent content by JonS

DIP40? The photos I've seen show a DIP42 package. Post 686 on this thread has a photo of a ROM reader board which can read DIP42 CPUs.

Unfortunately it looks like I binned the PCB. I do have a knock sensor IC from a dead 3VZ-FE ECU, the IC part number is D151802-8860. I also have a faulty main MCU from a later MR2 ECU, part number D151803-9651 if you'd like to look at that as well.

I've got a MR2 ECU that's been scavenged for various parts, if I can find it I can send you the knock IC.

The 4A-G(Z)E was produced in both speed density and air-flow versions, later versions used the same 64-pin Denso CPU.

For anyone who's interested in the dual MCU processor ECUs, here are a few photos showing the daughter boards fitted inside a 3S-GTE ECU. The H/W is a slightly different design but both this solution and 3p's solution share the same S/W.

Hi Todd, yes I got your PM, I've now replied.

You need to remove the data before 0x5000, the file should then be 0x3000 (12288 in decimal) bytes long. If the SW ID is 1383 then that is the number in hex, so just enter is as it is. You need to run the descrambler with: descramble_brute scm4840.bin 3000 1383

The "software_id" is a 16 bit number (in hex) that is stored in the ROM at a known position. The very same number is also stamped on the chip. For early chips the markings are: D15180x-xxxx 7433-yyyy where yyyy is the "software_id". On later chips the markings are: D15180x-xxxx...

After looking at the 3S ODB code a bit more, it certainly looks like it follows the same order of ODB data. There are the same number of bytes and RPM, MAP are definately in the same place. FLAGS #1 & #2 could also be the same but I haven't worked out the bits in the flags yet.

I've now found the ODB code in the 3S ECU, it's in the D151803-9661 MCU. The stream is generated in software from a timer, pin PA4 (31) is the inverted stream, pin PA5 is an active-low enable signal. There's a subroutine at 0xD0FF that fetches the next byte in the stream, a table at 0xD139...

Cool, that looks like a useful reference. I noticed a list of internal registers at the end, I can probably help out with that.

It could also be the code that handles the results from reading the ADC. Normally there's a another table (0xF0CA?) near by with the sequence of ADC 'channels' to read.

Thanks, that's very useful info. I can get the ECU generating the OBD like output and then probe with an oscilloscope to determine which pin on the MCUs is generating the signal. From that it should be possible to work backwards to find the code that generates the OBD bitstream. I've just...

I've been using the measurements from http://gtfour.supras.org.nz/mapsensor.htm, BAP give a voltage of 2.3293v on the MAP sensor. Fuel cut on the Rev 3 MR2 is ~18psi. In the ECU code this is represented by the value 0xDA00. From the above web page, the voltage on the MAP sensor at 18psi is...

I haven't figured out much beyond what's in the IDA projects for the 3S ECU. I'm currently trying to figure out the scaling of the maps but it's made tricky by the way the code modifies the inputs to the map interpolation routine. One example of how 'RPM' is manipulated to give *lower*...