3P's TCCS Disassembly/Analysis

[Nick M]

I need your help not to fry my 7M ECU when I get it.

This is the pinout of the ECU: http://www.geocities.com/MotorCity/Pit/9975/enginepix/drawings/ToyTCCS_Pins_7M-GE_87.gif

Assuming the few things I know about Toyota ECUs:
-Analog sensors (AFM, TPS, ITS, WTS) voltage should be between 0 and 5V
-Except O2 sensor which must be somewhere between 0.3V and 1.2V
-Except Knock sensor (not really analog), whose voltage output is unknown to me.

What about igniter signals, Test socket input, RPM sensor, Speed sensor, stop light switch?

Which ones are 0-5V and which ones are 12V?

The factory EWD is very detailed, as is the repair manual. One note, Toyota doesn't employ a typical 5 volt refrence on the ECT sensor. It compares voltage needed to overcome ther NTC resitor to a 5 volt refrence. I would have to get the book out to see what else though.

AFM is Hz, knock sensor is Hz, engine speed and position is analog pick up. I know JJ will assist as soon as he sees this.

 

[Brutus]

The factory EWD is very detailed, as is the repair manual.

AFM is Hz, knock sensor is Hz, engine speed and position is analog pick up. I know JJ will assist as soon as he sees this.

The TSRM sensor test procedure involves resistance tests, with the plugs disconnected from the ECU. They don't tell anything about voltages, as far as I know.

The AFM is a digital sensor involving pulse frequency on the 7MGTE with Karmann Vortex AFM.
I thought the 7MGE used a flapper door style AFM (which in that case involves an analog signal) ?

I also thought engine speed and position was resolved through the distributor with pulses (Something like 24 pulses for one cam revolution on Ne, IG1 on Cylinder 1 TDC and IG2 on BDC).

 

[3p141592654]

I think 400 rpm is the step size for the 3S-GTE maps. It would take you to 6400rpm. Given the redline for the 3S is 7200, I wonder wonder what happens above the map rpm?

The engine position signals are raw from the CPS coils so voltage should be a function of rpm, and probably small. No info on IGF and IGT

LP, AC, DFG, STA STJ, are 12V

Speed sensor is a grounded reed switch

Test TE1 is grounded or open

No karmen vortex Hz inputs for the 7MGE. We will tackle that wrinkle later.

 

[Doward]

GM OBD1 simply holds the last value until redline is reached. No extrapolating beyond the map.

This holds true on the '165, '730, '749, and '302 ECUs.

 

[Doward]

Gunnar,

If this is the way a fuel map must look, yes they are fuel maps! :icon_bigg

Attached are graph of maps at 0xdb26 and at 0xdbf8

The excel file requires to have the HEXDEC function enabled (tools, complementary macros).

OK, now obviously, the value going from 0 to 255 is the fuel enrichment.
One of the other value must be RPM (I think 16 value axis going by 400 rpm steps).
The other one must be air quantity measured by the AFM?

I doubt there are two fuel maps in the 7MGE ECU. JJ would know for sure, but a high/low octane mapping system wasn't common back in the 80s. That said, it DOES look like a timing map.

Odds are better that the fuel map on the GE, with a flapper style AFM, would be a 2D RPM vs AFM reading.

Timing would be an RPM vs AFM vs Load, perhaps. I know the GM '302 ECU (fq based MAF) calculates a 0-255 'load value' and applies RPM vs Load to calculate injector pulsewidth.

Just random info.

 

[Brutus]

GM OBD1 simply holds the last value until redline is reached. No extrapolating beyond the map.

This holds true on the '165, '730, '749, and '302 ECUs.

Yes, the ECU hold the values till redline (leaves a 800 rpm gap to the redline) or the rpm scale is 450rpm instead of 400?

I doubt there are two fuel maps in the 7MGE ECU. JJ would know for sure, but a high/low octane mapping system wasn't common back in the 80s.

I found these four maps in the ECU ROM, so they do exist inside.

That said, it DOES look like a timing map.

You mean the maps on the second post (0xeb8a and 0xec13)?

Odds are better that the fuel map on the GE, with a flapper style AFM, would be a 2D RPM vs AFM reading.

Correct me if I'm wrong, but if it's really 2D, this should be AFM reading vs injector pulse width. If we had RPM vs AFM, we would need a 3rd dimension for injector pulse width, and it looks like this is what we have.
I guess the GE maps are 2D with AFM vs airflow, but they'll need to convert this to injector pulse width somewhere using RPM (?).

Timing would be an RPM vs AFM vs Load, perhaps. I know the GM '302 ECU (fq based MAF) calculates a 0-255 'load value' and applies RPM vs Load to calculate injector pulsewidth.

Just random info.

This is it, it looks like GM convert it like that.

Of course these are still just assumptions for the 7MGE ECU, but we have these maps for sure, so they must be of some use.
To be confirmed with the use they make of them inside the code.

Thanks for helping!

 

[Doward]

Yes, the ECU hold the values till redline (leaves a 800 rpm gap to the redline) or the rpm scale is 450rpm instead of 400?

Very much more likely that it holds value to redline. I have no way to prove it, I'm going off of previously known examples in the GM world.

I found these four maps in the ECU ROM, so they do exist inside.

I'm not saying they don't exist - I just wonder if Toyota went with a 2D (which is usually what you find in a directly metered air system of the '80s) vs a 3D (what you find in an '80s SD system - rpm vs map vs VE)

You mean the maps on the second post (0xeb8a and 0xec13)?

First maps - 0xdb26 + 0xdbf8

Correct me if I'm wrong, but if it's really 2D, this should be AFM reading vs injector pulse width. If we had RPM vs AFM, we would need a 3rd dimension for injector pulse width, and it looks like this is what we have.
I guess the GE maps are 2D with AFM vs airflow, but they'll need to convert this to injector pulse width somewhere using RPM (?).

You're right - I shouldn't have said RPM vs AFM - it's just a load value vs injector pulsewidth, on the early GM MPFI systems. Toyota, being Toyota, I'm sure it's a more complicated scheme.

This is it, it looks like GM convert it like that.

Of course these are still just assumptions for the 7MGE ECU, but we have these maps for sure, so they must be of some use.
To be confirmed with the use they make of them inside the code.

Thanks for helping!

No problem!

I think what's throwing me off, is the 1-13 value points of graph 0x26db. If that was a fuel map, I'd expect that scale to run the other way, with 13 being the high value.

The 2nd two maps you have there look more like knock retard maps, or maybe amount of timing to pull vs coolant temp (in the case of overheating). I think maps 0xeb8a and 0xec13 are adjustment maps - either fuel or timing - based on some other sensor data. They aren't smooth enough to be full maps.

 

[Gunnar]

I'm not 100% sure they are fueling maps, but there is nothing else in there that could be fueling maps.
It's a strange ecu, since in motronic ecu files etc there are also large maps for the spark advance.

There is however maps that can be formed from all the single value maps. They could be alternating values of axis and mapvalue. I don't have the time atm to look into it a lot more, but i guess the next step will be to use a more recent denso ecu file that has definitions and work back from there.

Don't look at the axis values 1-13 they are just numbers , those values don,t come from within the file. In other petrol ecus there is usualy a linear map which holds axis values.

As for the scenarios where things exceed a map, in nearly all ecus, petrol or diesel the last value is used for the off-map range.

 

[Brutus]

Thanks a lot for the clues guys! :icon_bigg

Will let you know when I'll find something new!

 

[Nick M]

The TSRM sensor test procedure involves resistance tests, with the plugs disconnected from the ECU. They don't tell anything about voltages, as far as I know.

I know what you mean. But there are a few. The EWD shows pinout voltage, but that is sometimes just a range also. And it doesn't always match. Some of these guys have datalogged, or just used a meter to check things. For example the TPS doesn't make the 4.5 v typical of a 5 volt refrence. Only about 3.6 at WOT.

The AFM is a digital sensor involving pulse frequency on the 7MGTE with Karmann Vortex AFM.
I thought the 7MGE used a flapper door style AFM (which in that case involves an analog signal) ?

Yep. The book shows the voltage drop.

http://www.cygnusx1.net/Supra/Library/TSRM/MK3/manual.aspx?S=FI&P=32

http://www.cygnusx1.net/Supra/Library/TSRM/MK3/manual.aspx?S=FI&P=51


Another good site is Autoshop101. Go to the technical writings. Luckily, he has all the dated stuff just for us! The pick up is shown in fairl good detail. Enough for what you need? I don't think so. But hopefully it will help.

 

[Brutus]

Great! :icon_bigg

Didn't remember that part of the TSRM! :ban:

Thanks for your support!

 

[bfr1992t]

Wow, great work guys. I was about to set up a test bench and datalog the ECU externally.

The fuel maps look representative of many of our maps in standalone ECU's for 7M's, esp the jump at what should be about 2600 rpm if I'm reading these right. It would be a huge help if someone could find and decode the equivalent "breakpoints" table.

If another early 7MGE ECU is needed I can check if a friend of mine has one. We may have a spare 7MGTE ECU as well.

 

[Brutus]

The fuel maps look representative of many of our maps in standalone ECU's for 7M's, esp the jump at what should be about 2600 rpm if I'm reading these right. It would be a huge help if someone could find and decode the equivalent "breakpoints" table.

We still need to confirm what they are and the scales on the 3D map. This could be of great help if you could send data about fueling and ignition of standalone ECUs for 7MGE so I can build and 3D representation of these for comparison. :1zhelp:

What do you mean by "breakpoints" table?

If another early 7MGE ECU is needed I can check if a friend of mine has one. We may have a spare 7MGTE ECU as well.

Thanks for this, I should put a hand on mine tomorow, and a second one is on its way. :icon_bigg

 

[Brutus]

I think what's throwing me off, is the 1-13 value points of graph 0x26db. If that was a fuel map, I'd expect that scale to run the other way, with 13 being the high value.

Forgot to answer about this the other day.
Like Gunnar already said these values are only reprentative of the order where the data can be found in memory. By no means these values are found anywhere inside memory.

 

[Clip]

i'm sticking to the toolbox/wrench side of things, but this is incredible. blows my mind and makes me hate my programming classes a little less keep up the work!

 

[jetjock]

I doubt there are two fuel maps in the 7MGE ECU. JJ would know for sure, but a high/low octane mapping system wasn't common back in the 80s.

There aren't. However Toyota did use dual maps back then and several of their cars had octane select switches. It doesn't apply to the 7M though. No need.

 

[Brutus]

There aren't. However Toyota did use dual maps back then and several of their cars had octane select switches. It doesn't apply to the 7M though. No need.

Octane change isn't the only possibility there, couldn't this second map be a "some sensor failure" map or whatever?

Any clue what these map could be (0xdb26 and 0xdb8f) if they aren't fuel maps? :1zhelp:

 

[3p141592654]

There are at least two possible explanations for the two maps. From J. Ross's work we know that the MR2 of similar generation...

There are in fact two fuel maps, one for when the engine is spinning below 3200rpm and one for when it is above 3200rpm. The reason the density mapping is split into these two ranges is to allow a finer scale map for the lower engine speeds to get more precise fuelling (and emissions?) during urban driving. The density map for speeds above 3200rpm is more biased towards performance.

Also

The ECU has a reset map and a normal high-performance map. After an ECU reset the ECU reverts to some pretty crappy maps for fuel and ignition until it is happy that it can jump to the normal maps. This can take a while for the ECU to make the changeover.

It is actually possible to datalog the self learning as it has a kind of progress value set in ECU memory and it won't swap maps until this gets to the threshold. It's possible to display the value on the laptop and watch it increment up and you can watch it swap the map 'switch' flag in memory and then you know it's onto the normal maps.



We will get to this and other stuff as the disassembly progresses.

 

[Doward]

JJ's got more documentation than anyone I know of on the TCCS.

I'd bet that you are looking at the main fuel graph, main ignition table, and looking at two adjustment tables.

 

[Brutus]

Did some bench test and route tracing this weekend to identify the wiring of the sensors and actuators to the processor.
The help provided by you guys on ECU wiring last week was very helpful, thanks again.

Here's what I've found so far:
ASR2 is NE
ASR3 is SPD
PB6 is TE1
PA4 is IG1
PA5 is IG2
PA1 is linked to knock sensor CPU
PA2 is linked to knock sensor CPU
PD0 is ECT
PD1 is L1
PD2 is L2
PD3 is L3
PC5 is STA
PC0 is IDL
DOUT1 goes to injector driver IC
DOUT2 goes to injector driver IC
DOUT3 goes to injector driver IC
DOUT5 goes to injector driver IC
DOUT6 to injector signal amplifier (HC095) fuel cut?
DOUT7 to injector signal amplifier (HC095) fuel cut?

... then my multimeter stopped working... :cry:

The PA port is hardly ever tested in the code. This leads me to believe some (if not all) of it's pins trigger an interrupt. This would make sense for IG1 and IG2, for instance.

Seems to me there's some trouble with disassembling opcode 0x8c, which is interpreted as "cmp x, #mmll" with mm and ll being the two bytes following the 0x8c opcode.
There's plenty of references to this opcode in the program, and many times if you search for "cmp x,", this doesn't seem accurate regarding the code around.

Example: (disassembler in red, my assumptions in blue)
f6dc 371f12 tbbc b.0, $_OMODE, 0xf6f1
f6df 33ffd1 ld #0xff, $0xd1
f6e2 797aa9 cmp #0x7a, $0xa9
f6e5 4406 bcc 0xf6ed
f6e7 76a9 inc $0xa9
f6e9 355901 tbbs b.2, $_ASR2L, 0xf6ed
; f6ec 8c7773 cmp x, #0x7773 wrongly disassembled
f6ec 8c ; what the hell is that byte for?
f6ed 7773 setb bit3, $_ASR0NL
f6ef 400a bra 0xf6fb
f6f1 7573 clrb bit3, $_ASR0NL

New version is available on http://svn.assembla.com/svn/7M_TCCS, along with a excel file displaying almost all the maps in graphical format.

Any help/comments/flamming welcome.