3P's TCCS Disassembly/Analysis
- Thread starter 3p141592654
- Start date
3p141592654;1649419 said:My present came early this holiday! Time to get out the soldering iron.
wow, have fun with that haha. how much did that cost to have made?
I use Gold Phoenix to make these boards. Due to the complex shape and double sided silkscreen this cost $180 for 155sqin of board area.
Yup, that board uses 0.5mm pitch parts, and is really not very suitable for hand soldering. With the right tools and a microscope it can (will) be done though! The real cost of that board was the layout, which took alot of hours to put together.
Looks like someone's got a fun weekend planned then 
If these go into 'mass' production, will they be hand assembled, or machine assembled?
If these go into 'mass' production, will they be hand assembled, or machine assembled?
These boards are not suitable for hand assembly, although a few will go together that way. They would need to be contract assembled in volume. Fortunately there a lot of places that can do that kind of stuff. I have all the chip components attached, now the fun 0.5mm pitch parts need to go on.
Well I figure I'll post up an alpha version of what I'm working on. I intend to be writing some new features for a co-workers 7M, as I've done in the past for my GM vehicles. Well Motorola 6811 emulators are pretty common, but nothing exists for the Toyota CPU of course. So anyway I've whipped together a quick emulator which I'm still working on. It is written in C# so I could build it quickly, as GUIs in C++ are definitely not my strong suit. It is very basic at the moment, even lacking interrupt support. You can step through the main loop though, modify the entire memory space, and change registers while paused. Nothing too flashy yet, but its a small step for what I hope to test my code in.
I currently do not have an ECM to be figuring out how it works, it has all been off of the posted documents and 3p's help. Hopefully someone can explain to me how the interrupts work, which interrupts the IMASK value controls, and how the inputs trigger which interrupts.
Anyway the next features planned are interrupt support, memory breakpoints, and profiles for different ECMs so you can modify inputs, such as NE, G1 and G2, ignition switch, or STA to watch how the ECM supplies fuel/spark under different conditions.
Hopefully someone other than I will find this useful, so please let me know if you think anything else should be added. If you have .NET 4 Client Profile, you can just use the exe, otherwise use the setup file as it will install any necessary requirements.
I currently do not have an ECM to be figuring out how it works, it has all been off of the posted documents and 3p's help. Hopefully someone can explain to me how the interrupts work, which interrupts the IMASK value controls, and how the inputs trigger which interrupts.
Anyway the next features planned are interrupt support, memory breakpoints, and profiles for different ECMs so you can modify inputs, such as NE, G1 and G2, ignition switch, or STA to watch how the ECM supplies fuel/spark under different conditions.
Hopefully someone other than I will find this useful, so please let me know if you think anything else should be added. If you have .NET 4 Client Profile, you can just use the exe, otherwise use the setup file as it will install any necessary requirements.
Last edited:
Awesome, an emulator is the last missing development tool. I can help with the interrupt table, and a few of the other features of this MCU.
Well here's something you don't see everyday, a 7M ECU with a micro usb connector. So far so good, basic functionality checks out, now need to see if we can run the ECU from it.
Manianac;1650749 said:
I like it, would it be possible to use the listing from IDA which had been commented in the trace (Disassembler) window & add a few instruction ahead of the current execution && have the trace log to file .
Great work on the emulator
Ya its all possible, a commented disassembly is definitely something I wanted to do. Possibly like loading the entire file and just highlighting the currently executed line. What I posted is basically just a proof of concept, it has a very long way to come to be anything useful.
I don't know exactly what your plans are but is there any hope down the road the mod and chip you're creating will have the option/feature to: 1. replace the Karman setup with a map like the turbo A or some other alternative 2. alternative firing methods (ie single coil, no waste spark setup) 3. large injector correction
First feature being the best/most ideal
First feature being the best/most ideal
I've bounced in and out of this thread infrequently so forgive me if this has been long covered; but, any thought or mention of timing monitor/control?
That ~7* Advance at 5200-5500 rpm is just killing me!
That ~7* Advance at 5200-5500 rpm is just killing me!
Yes, there is some kind of timing control. I read it but I don't know which page it was on.
They are really close on this project and I hope it turns out well.
There is one factory ECU that is my favourite. The Evo ECU's can be flashed and reprogrammed like a standalone, no joke. Google it. Those dudes are lucky, they do an upgrade, plug in the laptop and tune.
They are really close on this project and I hope it turns out well.
There is one factory ECU that is my favourite. The Evo ECU's can be flashed and reprogrammed like a standalone, no joke. Google it. Those dudes are lucky, they do an upgrade, plug in the laptop and tune.
MA70witBoost
Registered Drifter
How simple a tuning setup are you guys going for? Will this be something that would have to be taken to an experienced tuner with a dyno or can we properly street tune with a laptop and a wideband?
Even better than a MAP, a Hitachi built hot wire mass air flow Ford unit from the Ford GT. I think it is 90mm.
Quite late, but I'd like to brush up on this side of my life so am planning to have a bit of a play with this In particular I'd like to work on the documentation that's available for others
To get me started I've thrown the following schematic together (based off kashima and 3p's), if anyone who has first hand experience could have a look and see if I've made any obvious mistakes that would be appreciated
Secondly I've got a few ECUs here atm, 7MGE (not sure what exact Toyota Part number, D151801-8630, 7433-1129, 8J1465), 2JZGE (89661-14610 JZA80, D151803-6021, 5A41C-2-8206, JAPAN 4C1435) and another 2JZGE ex JZS147 and 2 of 1JZGTE JZZ30 ecus...
Does anyone know if the D151803-6021 as found in the 2JZGE ECU is equivalent to the D151801/2 and will work in the reader?? It's clocked at 16MHz
A few pics of the 2JZGE ECU.
Cheers
Wilbo
In particular I'd like to work on the documentation that's available for others To get me started I've thrown the following schematic together (based off kashima and 3p's), if anyone who has first hand experience could have a look and see if I've made any obvious mistakes that would be appreciated
Secondly I've got a few ECUs here atm, 7MGE (not sure what exact Toyota Part number, D151801-8630, 7433-1129, 8J1465), 2JZGE (89661-14610 JZA80, D151803-6021, 5A41C-2-8206, JAPAN 4C1435) and another 2JZGE ex JZS147 and 2 of 1JZGTE JZZ30 ecus...
Does anyone know if the D151803-6021 as found in the 2JZGE ECU is equivalent to the D151801/2 and will work in the reader??
It's clocked at 16MHz A few pics of the 2JZGE ECU.
Cheers
Wilbo