3P's TCCS Disassembly/Analysis

Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
My present came early this holiday! Time to get out the soldering iron.

p1649419_1.jpg
 
Last edited:
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Yup, that board uses 0.5mm pitch parts, and is really not very suitable for hand soldering. With the right tools and a microscope it can (will) be done though! The real cost of that board was the layout, which took alot of hours to put together.
 
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
These boards are not suitable for hand assembly, although a few will go together that way. They would need to be contract assembled in volume. Fortunately there a lot of places that can do that kind of stuff. I have all the chip components attached, now the fun 0.5mm pitch parts need to go on.
 

Manianac

New Member
Oct 9, 2010
11
0
0
Indy
Well I figure I'll post up an alpha version of what I'm working on. I intend to be writing some new features for a co-workers 7M, as I've done in the past for my GM vehicles. Well Motorola 6811 emulators are pretty common, but nothing exists for the Toyota CPU of course. So anyway I've whipped together a quick emulator which I'm still working on. It is written in C# so I could build it quickly, as GUIs in C++ are definitely not my strong suit. It is very basic at the moment, even lacking interrupt support. You can step through the main loop though, modify the entire memory space, and change registers while paused. Nothing too flashy yet, but its a small step for what I hope to test my code in.

I currently do not have an ECM to be figuring out how it works, it has all been off of the posted documents and 3p's help. Hopefully someone can explain to me how the interrupts work, which interrupts the IMASK value controls, and how the inputs trigger which interrupts.

Anyway the next features planned are interrupt support, memory breakpoints, and profiles for different ECMs so you can modify inputs, such as NE, G1 and G2, ignition switch, or STA to watch how the ECM supplies fuel/spark under different conditions.

Hopefully someone other than I will find this useful, so please let me know if you think anything else should be added. If you have .NET 4 Client Profile, you can just use the exe, otherwise use the setup file as it will install any necessary requirements.

screenshot..png
 

Attachments

  • D8XEmulatorAlpha_&#.zip
    581 KB · Views: 27
  • D8XAlpha_EXE..zip
    352.7 KB · Views: 22
Last edited:
Oct 11, 2005
3,816
16
38
Thousand Oaks, CA
Well here's something you don't see everyday, a 7M ECU with a micro usb connector. So far so good, basic functionality checks out, now need to see if we can run the ECU from it.

p1653166_1.jpg
 

auto351

New Member
Oct 22, 2008
19
0
1
Sydney
Manianac;1650749 said:
Well I figure I'll post up an alpha version of what I'm working on.

I like it, would it be possible to use the listing from IDA which had been commented in the trace (Disassembler) window & add a few instruction ahead of the current execution && have the trace log to file .

Great work on the emulator
 

Manianac

New Member
Oct 9, 2010
11
0
0
Indy
Ya its all possible, a commented disassembly is definitely something I wanted to do. Possibly like loading the entire file and just highlighting the currently executed line. What I posted is basically just a proof of concept, it has a very long way to come to be anything useful.
 

IwantMKIII

WVU MAEngineering
Jun 12, 2007
2,477
0
0
Perkasie, PA
I don't know exactly what your plans are but is there any hope down the road the mod and chip you're creating will have the option/feature to: 1. replace the Karman setup with a map like the turbo A or some other alternative 2. alternative firing methods (ie single coil, no waste spark setup) 3. large injector correction

First feature being the best/most ideal
 

CajunKenny

PULL MY FINGER. PLEASE!
Nov 15, 2007
3,255
0
0
Washington
I've bounced in and out of this thread infrequently so forgive me if this has been long covered; but, any thought or mention of timing monitor/control?

That ~7* Advance at 5200-5500 rpm is just killing me!
 

IBoughtASupra

New Member
Mar 10, 2009
4,455
0
0
Queens, NY
Yes, there is some kind of timing control. I read it but I don't know which page it was on.

They are really close on this project and I hope it turns out well.

There is one factory ECU that is my favourite. The Evo ECU's can be flashed and reprogrammed like a standalone, no joke. Google it. Those dudes are lucky, they do an upgrade, plug in the laptop and tune.
 

funky_monkey58

Closing in on 200+MPH
Apr 3, 2006
1,307
0
36
St.cloud MN
IBoughtASupra;1653764 said:
Yes, there is some kind of timing control. I read it but I don't know which page it was on.

They are really close on this project and I hope it turns out well.

There is one factory ECU that is my favourite. The Evo ECU's can be flashed and reprogrammed like a standalone, no joke. Google it. Those dudes are lucky, they do an upgrade, plug in the laptop and tune.
Same with pretty much all GM ECU's.
 

wilbo666

New Member
Dec 18, 2010
4
0
0
QLD
Quite late, but I'd like to brush up on this side of my life so am planning to have a bit of a play with this :) In particular I'd like to work on the documentation that's available for others :)

To get me started I've thrown the following schematic together (based off kashima and 3p's), if anyone who has first hand experience could have a look and see if I've made any obvious mistakes that would be appreciated :)



Secondly I've got a few ECUs here atm, 7MGE (not sure what exact Toyota Part number, D151801-8630, 7433-1129, 8J1465), 2JZGE (89661-14610 JZA80, D151803-6021, 5A41C-2-8206, JAPAN 4C1435) and another 2JZGE ex JZS147 and 2 of 1JZGTE JZZ30 ecus...

Does anyone know if the D151803-6021 as found in the 2JZGE ECU is equivalent to the D151801/2 and will work in the reader?? :) It's clocked at 16MHz :)

A few pics of the 2JZGE ECU.








Cheers
Wilbo