3P's TCCS Disassembly/Analysis

[3p141592654]

Unfortunately you will not find datasheets for the Denso parts, at least I haven't. From trial and error we know

From 7MGE....
40pin denso is used for DSP of the knock sensor. It communicates to the main processor using a few of the ports.
HC150 (5V regulator)
D949577 is the ADC
MF165 backup fail safe IC for fuel/ign that runs the engine with a major failure (such as a dead AFM)
SE022 timer/comparator to trigger backup IC

HC154 filter/voltage converters for sensors.
HC095 Fuel Inj Control

Other variants of these chips are common. The 7MGTE uses a different backup IC that handles the waste fire spark addressing for example.

 

[Kai]

Aaaha! Thanks Jon

Have any of the denso parts been pinmapped at all - ie - vcc, gnd, i/o etc? If so - can i get in on that?

I have toshiba datasheets for almost every other part in there (handy that it even comes with a circuit schematic of the internals), and would like to build up a schematic of the whole ECU if at all possible.

 

[3p141592654]

Henri (Brutus) has done all the hardware analysis. He hasn't published anything on the pinouts of those parts. The tall SIP packages actually contain hybrid circuit boards with components attached to a ceramic carrier. Very advanced for the time, typically only seen on military systems of that vintage.

For fail safe operation on the 7MGTE, three chips are involved (instead of two for the 7MGE). They are SE022 (timer/comparator, I think), MF166 and MF122.

Do you have the datasheet for the Toshiba TD6335BP chip. I can't find it anywhere. It looks like it should be a serial multiplexer. I found TD6330 and TD6336, but TD6335 is a mystery.

 

[Kai]

Says here that it's a stepper motor driver, i presume for the ISCV?

 

[3p141592654]

I am pretty sure the stepper motor driver is the MP4501 (it is for the 7MGE). Do you have any additional info on the TD6335? Pinouts?

 

[Kai]

Nope - the datasheet labelled as the TD6335 came up as the 6330 which is the stepper motor driver - it's like the only Toshiba IC that DOESN'T have a datasheet, other than the main CPU...

On that subject, it may have been mentioned before, or common knowledge, but comparing the Toshiba 8x with the Motorola 6809, the actual CORE of the MCU seems to be 99% identical to the 6809 on the register level, although the 8x doesn't implement FIRQ or Entire Flag in the Condition Control Register by the looks of it.

Even better - the MC68HC11E9 looks IDENTICAL in terms of pinout (in the 64-pin QFP format), has 12k of ROM, 512bytes of memory.

I have the original Motorola datasheets with the assembler programming aid, if that's of any use?

Would it not be possible to break down the components of the Toshiba 8x MCU into its constituent parts on a daughterboard? IE - MC6809 Core, memory & ROM - or am i talking out of my arse here?

Oh, and just as an FYI - i've discovered what the part number of the knock sensor CPU is! Fujitsu MB88xxx series - the 4AGE uses an MB8874N, the ECU i have for my Supra is an MB88411 - and i have a datasheet for the whooole family!

See this for more information:

 

[3p141592654]

Shoot, the TD6335 seems to be a mystery.

That is interesting about the knock sensor. I wonder if they used fujitsu as a second source because the instruction sets of the Knock sensor (at least for the 7M ECUs) is the same as the main chip which is thought to be Toshiba.

While the Denso addressing scheme and register structure are similar to the 680x Motorola chips, they have very different opcodes and i/o. The Denso chips have registers to capture timing events, programmable output latches, and builtin serial i/o. The 680x does not have this stuff. Also, the Denso chip has 256 unique opcodes, quite a bit richer than the 680x line. The 12MHz and later 16MHz clocks are also faster than what the 680x could clock at the time. I think the MCU was designed by a team that was familiar with the 680x processor, but wanted to make something more capable for ECU applications.

If you can make the datasheet for the MB88xxx series available to the community that would be great.

 

[Kai]

Sure thing boss

http://kai.robinson.free.fr/dropbox/Supra/Fujitsu MB88400 4-bit MCU.pdf

And this is the whole MB88 series lineup, for comparison purposes:

http://kai.robinson.free.fr/dropbox/Supra/Fujitsu MB88 Series MCU.pdf

There you go!

 

[3p141592654]

Very nice, thanks. The automatic transmission ECU uses a Fujitsu chip. I wonder if it is related to this one.

 

[Kai]

If you have a picture of the board, i'll start doing some research. Was looking at the Fujitsu Operand /Mnemonic lists - doesn't look too similar to what we're pulling out of the ECU - which is odd...

*edit*

Well, i think i figured out something - the MB88400 series datasheet i have only covers the basic model, the MB88411 in the ECU has a built in ADC - but i can't find any datasheet on it, and Fujitsu denies it ever existed, at least as far as their part search goes.

I have an idea however, the guy thats reworking my engine wiring harness works for Fujitsu as a coder, he might have access to a whole host of shiz that isn't made public. I'll ask if he can dig out a datasheet.

Still, i must admit, that's as close to the MCU as we've seen thus far.

Whilst searching around for variants of the MCU however, i stumbled across US Patent 4,770,144 - which describes the operation of the knock control system designed by Denso, which includes the MB88413 as its main CPU (smaller PROM). Might be worth a look.

 

[3p141592654]

Two pictures of the A/T ECU. The markings says TEN, as in Fujitsu TEN.

 

[Kai]

Thanks dude. Did that PDF come in handy at all?

*edit*

Not finding ANY matches to anything by Fujitsu TEN - who seem to make only car audio stuff these days. Is there anything silkscreened onto the PCB with an IC number or something? Can anyone else with one of these post up an interior picture of their Auto ECU? I just opened up my Auto ECU and same part number, but different mask. It's definitely a Fujitsu IC, but god only knows what it's REAL part number is...

I've been applying occams razor - the *only* 40-pin MCU's that Fujitsu have *ever* made during the time period the Auto ECU was made, was the Fujitsu MBL68B09 - from the datasheet crossreferencing i've been doing - the MC6821 and the MC6840 connect to it. The MB8874E/N is 40-pin but was obsolete by 1985.

The MB4212 looks like an LM339 Comparator - but like the TD6335 - no datasheet or concrete evidence, just supposition & theory so far.

 

[Kai]

Just as an FYI - i also got hold of some decent hires internal shots of the 1JZ Auto ECU, three D151802's in there - two 64-pins and a 42-pin and it looks a lot harder to decipher, as not even the silkscreening gives anything away! Can post them up out of general interest if you want.

 

[3p141592654]

The 1JZ uses the same dual ECU architecture of the MKIV SUpra, MK3 MR2, Camry etc of that era. Jon Sole has made good progress on using one of our boards to replace the fuel ECU. Ultimately, he plans to replace both ECUs so that ignition can be modified too. I'll leave that to him for now though. That ECU has more ROM (16kB), 8 instead of 4 programmed output ports (can drive injectors individually instead of in banks like the 7M), runs at 16MHz instead of 12MHz, and has more RAM. Otherwise though, it has the same instruction set and basic footprint.

 

[Kai]

Aaaah okay

Did that datasheet reveal anything new?

*edit*

There's another one of these cropped up: http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=290412379557

 

[3p141592654]

Okay, an updated IDA module is on Assembla. It fixes the BRN problem Manual discovered, and it add a lot of outputting enhancements that Jason (3rotor) worked out . Finally, for those working on later MCUs with the larger ROM, extended outputs, and so on, there i an updated cfg file for that processor courtesy Jon Sole. Thanks to everyone who has helped to make this better.

Jon,

I see byte saving techniques, I wasn’t clear in my PM, the problem I saw was the way IDA handled / interoperates the instruction BRN, IDA looks at the following byte (after BRN) and converts that to a branch address (which is correct) , IDA then assumes that address in a valid branch & contains code (which is incorrect)
In my case address D26D is data not code.
I got the code and put (2) NOP NOP at address D204 & D205 when this was disassembled the address D26D was taken as data as I expected. Looking at the original instructions at address D26D down you have 3 CMP which has no effect.
I know the code will not run with NOP in the above locations, as you said the BRN in like NOP in part, I wanted to test what would happen to a NOP in the same location.

My understanding is the modules Dx8.cgf & Dx8.W32 were custom written to work with the Toshiba within IDA, so it needed to be programmed/configured to understand the processors instructions, I wonder if it’s possible to change this interpretation of BRN so there is no branch assumed.

In my code there are 5 inconsistencies which resulted due to the current BRN interpretation, no big deal just nice to fix.

 

[Kai]

Again, just something that might be of interest:

http://forums.lorddigital.com/Project/Track Car/ECU and TURBO/Output/pages/IMG_7332.htm

 

[3p141592654]

I actually have that ECU because LordDigital loaned it to me a while back. It was the ECU where we learned how they scramble the data, and also allowed us to identify what stuff they change. I need to send it back to him...

I am really close to my first attempt to run the ECU with our board attached. Hope to have a few dry runs next week on the bench.

 

[Kai]

Done the same way as the TechTom? As in CPU removed, inserted into daughterboard w/external ROM, daughterboard soldered to ECU?

 

[3p141592654]

Not quite. I have an adapter board that plugs into the ECU board, and then use some FFC ribbon cables to go to the Flash board.

This weekend I finished a simple ECU simulator that allows the ECU to be powered up and some basic functionality tested. This is easier than having to plug the ECU into the car to test things.