3P's TCCS Disassembly/Analysis
- Thread starter 3p141592654
- Start date
Hi, some good progress, good work guys
Has anyone had any luck with the mines ECU as far as decoding, I have one here and dont know if it has its data & address lines crossed (making it harded to extract the true code), I wanted to see what changes they made to the code, the ECU is for the 1G
Manuel
Has anyone had any luck with the mines ECU as far as decoding, I have one here and dont know if it has its data & address lines crossed (making it harded to extract the true code), I wanted to see what changes they made to the code, the ECU is for the 1G
Manuel
You can check out post #139 for a discussion on the Techtom scrambling. We have not looked at Mines but it can't be much different i would think.
I've powered up the ECU with the Flash board installed but it is not working properly. :icon_mad: More debugging underway.
I've powered up the ECU with the Flash board installed but it is not working properly. :icon_mad: More debugging underway.
Question for you - the L1, L2 & L3 Pins from the ECU, i know that they're primarily for the TEMS computer, but in A/T models they connect to the ECT ECU as well - they're outputs of the throttle position, i'm guessing, but are they generated by discrete components on the lower board, based on VTA, IDL & E2? If so - is there any way to show what each channel should output as the throttle is increased/decreased on a bench setup?
The L1,L2,L3 outputs are a 3 bit digitization of the first derivative of the throttle position. The code calculates the difference between the instantaneous throttle position and a running average position, and then uses a lookup table based on this value to select the L1/L2/L3 bits. There is a peak hold feature too, so when you punch the throttle the value is held even after the throttle position stops changing.
You will note from the table that the peak value (assuming Lx represents a number) occurs for not the most aggressive throttle opening, but something backed off from there. Its a bit of a puzzle.
The lookup table data is as follows:
Map_ECT_TPS2: .db 00h ; 000x only interested in value of bits 1,2,3 (L1, L2, L3)
ROM:EE18 .db 08h ; 100x
ROM:EE19 .db 0Ch ; 110x
ROM:EE1A .db 04h ; 010x
ROM:EE1B .db 06h ; 011x
ROM:EE1C .db 0Eh ; 111x
ROM:EE1D .db 0Ah ; 101x
ROM:EE1E .db 02h ; 001x
It would be good to have some measured data to compare with, something I have not done.
You will note from the table that the peak value (assuming Lx represents a number) occurs for not the most aggressive throttle opening, but something backed off from there. Its a bit of a puzzle.
The lookup table data is as follows:
Map_ECT_TPS2: .db 00h ; 000x only interested in value of bits 1,2,3 (L1, L2, L3)
ROM:EE18 .db 08h ; 100x
ROM:EE19 .db 0Ch ; 110x
ROM:EE1A .db 04h ; 010x
ROM:EE1B .db 06h ; 011x
ROM:EE1C .db 0Eh ; 111x
ROM:EE1D .db 0Ah ; 101x
ROM:EE1E .db 02h ; 001x
It would be good to have some measured data to compare with, something I have not done.
Last edited:
Poodles;1567257 said:You mean raised fuel cut and reprogrammed for 550's, no lex needed
Actually, a large MAF sensor would be ideal.
Poodles;1567426 said:MAF's aren't as accurate, screw that, if it can be modified to run MAP it would rock
PARDON????????
(might want to rethink that one Poo)
I think you will need to have a Lex, because the dynamic range of the stock AFM will still saturate for air flow above a given value. There would not be any way to calibrate that out.
---------- Post added at 03:14 PM ---------- Previous post was at 03:11 PM ----------
I have got the ECU to run with the modified controller board. It is not reliable however, you have to disconnect the battery to get it to restart! :1zhelp:
Progress with every small step....
---------- Post added at 03:16 PM ---------- Previous post was at 03:14 PM ----------
A MAF sensor is not crazy, there are unused channels on the ADC, but would require some serious code tweaking to work. The GE ECU would probably be a better starting platform since it uses a voltage based AFM.
---------- Post added at 03:14 PM ---------- Previous post was at 03:11 PM ----------
I have got the ECU to run with the modified controller board. It is not reliable however, you have to disconnect the battery to get it to restart! :1zhelp:
Progress with every small step....
---------- Post added at 03:16 PM ---------- Previous post was at 03:14 PM ----------
A MAF sensor is not crazy, there are unused channels on the ADC, but would require some serious code tweaking to work. The GE ECU would probably be a better starting platform since it uses a voltage based AFM.
IJ.;1567430 said:
MAF compared to the AFM we have. If you're going to go through the work of changing the system it would be best to go MAP (to avoid boost leak issues)
3p141592654;1567434 said:
Pro-M, who builds larger thans tock mass air meters said they would do it for me, at a price. For the GE. Good point about the computer.
The MAF is the most accurate and best way. And I don't see this as debatable, but my proffessional opinion.
How about hooking up a 7M TPS to the ECU on the bench? Without the engine running, and just ignition on, it's still passing values to the autobox ecu when you push the loud pedal....
Also - http://datasheets.chipdb.org/Hitachi/6301/HD6301V1.pdf
I thought that might be of interest, particularly page 15 to 17 - i know it's not a Toshiba, but, the Hitachi 6301 added and altered some 6800 instructions and it might, *might* be worth a look at. I know i'm clutching at straws, but i'm still not giving up on finding more information on this MCU!
Also - http://datasheets.chipdb.org/Hitachi/6301/HD6301V1.pdf
I thought that might be of interest, particularly page 15 to 17 - i know it's not a Toshiba, but, the Hitachi 6301 added and altered some 6800 instructions and it might, *might* be worth a look at. I know i'm clutching at straws, but i'm still not giving up on finding more information on this MCU!
super.secret.supra.club;1577516 said:
I know how a computer works, in terms of a semi conducter, base, emitter, and collector, and voltage functions, but have no idea on code writing. You aren't alone.
One step at a time! Ran into a couple of problems with powering the board up and down properly, and also there is a control register for port B that we did not implement properly. Working to figure out how that works and get it into the board design.
If anyone knows Kanji, please translate this. It is a "nugget" hidden in the Techtom software
艱 艤 艠 艣 艨 艭 艦 [2082] 节 [餠] 艳 艤 艢 艧 艳 艮 艬
In unicode it is:
8271 8264 8260 8263 8268 826D 8266 [2082] 8282 [9920] 8273 8264 8262 8267 8273 826E 826C
Goggle comes up with the following!
Google: Chinese (Simplified) - English
Difficult Beirut has boat oar ship outfitting Deng [ 2082 ] section of [ Bing ] Qiang Huo Yan Yan Gen large ship outfitting
艱 艤 艠 艣 艨 艭 艦 [2082] 节 [餠] 艳 艤 艢 艧 艳 艮 艬
In unicode it is:
8271 8264 8260 8263 8268 826D 8266 [2082] 8282 [9920] 8273 8264 8262 8267 8273 826E 826C
Goggle comes up with the following!
Google: Chinese (Simplified) - English
Difficult Beirut has boat oar ship outfitting Deng [ 2082 ] section of [ Bing ] Qiang Huo Yan Yan Gen large ship outfitting
Code:
[****] 艠 艣 [**] 艭Warship 2082 节 [**] 艳[****] 艧 艳 [**] 艬]I hope thats what your looking for, I have no idea haha
I had it, it was numbers, but when i copy it in here the numbers disappear
http://www.excite.co.jp/world/english/ that is the website, it will translate it for you
