Funny adventures in electrical engineering

[MarkT]

No, I wasn't clear. The ecu is a 94 (maybe?) SC400 part. I have modified it in a manner similar to tuned MKIII supra ecus, but with parts I built myself.

So definitely what I've done can be done to an SC400, my car thinks it's a SC400 anyways. The LS400 PCM is basically the same and would accept the same modification.

Now I haven't looked at a '99, and it may be drastically different, but I'm always up for some hacking.

The pic's that disco_cat posted on 1-14-2016 is exactly what my 1999 SC400 ECU looks like same PCB number..
Im not sure if his pic was from a sc400 or a similar car.. I can take some pics of the ECU and send them to you..
I like the YouTube link you send on the throttle conversion kit.. thats what I was thinking to make.. could not tell
if they have one for the 1UZFE tho...

[UZ_Swap]

Any updates here guys? Very interesting thread.

[disco_cat]

8-bit ecus seem to have been cracked locally to me
16-bit ones might be supported in future
Having personally tested Tom's ecu for 1uz-fe vvti I can't see too many reasons one might want it, or equivalent solution

[UZ_Swap]

I have a mild cams, ITBs on OEM computer and fuel signal interceptor < this is non-vvti 1UZ.

Adjusting timing/fuel tables that others have spoke of would be excellent; speed cut is a plus and does away with jagging another aftermarket component onto the loom somewhere.

Personally I'm hoping someone breaks outs the non-vvti computer and adds a multiplexer to run individual coil packs sequentially.

[disco_cat]

I have a mild cams, ITBs on OEM computer and fuel signal interceptor < this is non-vvti 1UZ.

Adjusting timing/fuel tables that others have spoke of would be excellent; speed cut is a plus and does away with jagging another aftermarket component onto the loom somewhere.

Personally I'm hoping someone breaks outs the non-vvti computer and adds a multiplexer to run individual coil packs sequentially.

cheap standalone like the MS would be cheaper and more efficient

[Sparkie]

Personally I'm hoping someone breaks outs the non-vvti computer and adds a multiplexer to run individual coil packs sequentially.

That's not hard to do at all on my setup, just some code and a few extra pins on the cpld, plus 8 FET drivers.

cheap standalone like the MS would be cheaper and more efficient

Hell yes it would.

[MarkT]

No, I wasn't clear. The ecu is a 94 (maybe?) SC400 part. I have modified it in a manner similar to tuned MKIII supra ecus, but with parts I built myself.

So definitely what I've done can be done to an SC400, my car thinks it's a SC400 anyways. The LS400 PCM is basically the same and would accept the same modification.

Now I haven't looked at a '99, and it may be drastically different, but I'm always up for some hacking.

Sparkie..

Did you ever get to free up some time from your work, to consider hacking a 2000 lexus SC400 VVT ECU. I have one I can donate to the task..

Mark

[MarkT]

Sparkie, do you ever plan to work on newer ECUs?
I have factory tuned 1UZ VVTi ECU (1997-2000), it's still based on Toshiba 9000 series CPU, which is still mask ROM based, I believe (though I may be wrong here)
The add-on board found in the ECU seems to have the Toshiba processor, two UV EPROM chips (one being removable) and a FPGA
There's also a jumper which enables the CPU to run off ints internal memory
I dumped both memories just incase
The removable one is connected to FPGA and it seems to have maps only
The fixed one's content looks more like some code

Disco Cat, where did you get a factory tuned 1UZ ECU at ???
Also did you or Sparkie ever get any of the program pulled from the CPU's ??
thanks
Mark

[disco_cat]

I got it from Yahoo Auction in Japan, searched for quite a while
And it wasn't worth it
Get 3UZ and send it to me to get ramapped, that's it
I support any 3UZ ecu ever produced

[disco_cat]

p/s well the tom's ecu was not entirely useless actually
OTP memory chip, the one in socket, is not encoded and contains maps

[TheBeckoner]

Hi, I came across this thread in my research for the toshiba tlcs-9000. Im curious if there has been anymore progress with hacking that chip? Im dealing with a 99 ECU made in 98 that has a 97CW42AF chip along with some Denso chip that has MG489 on it. I read through the Datasheet on it (the 9000) and most of the instructions and from what I can tell the 9000 series isnt re-programmable due to the masked rom. Has anyone managed to get the maps off of it and bypass the internal rom and use an external rom chip? Is that sort of thing possible? Im very new to this sort of thing but also very interested in getting into it! Thanks

[Sparkie]

https://archive.org/details/tmp97c241
https://archive.org/details/tlcs9000_instman

this is the most I could get about the tlcs-9000 series of micros. it'd be a ground up custom job to get anything going with that chip, I can't even find an off the shelf disassembler for it, we'd have to throw together a plugin for IDA.

Have you any more tlcs 9000 information?

[TheBeckoner]

https://archive.org/details/tmp97c241
https://archive.org/details/tlcs9000_instman

this is the most I could get about the tlcs-9000 series of micros. it'd be a ground up custom job to get anything going with that chip, I can't even find an off the shelf disassembler for it, we'd have to throw together a plugin for IDA.

Have you any more tlcs 9000 information?

Well I found a macro-assembler for it but that's about it. I also read the some versions had eeproms or flash memory internally but obviously there is no version list so that's really up in the air. certain ones could also come romless but its safe to say the one on the board Im dealing with isnt romless otherwise it would have to have an external chip, right?

[Sparkie]

Yeah the one you have on that board is gonna be shipped with mask ROM or OTP ROM, certainly nothing that we can change.

The general strategy is always to run the chip in external mode (like romless, but its just ignoring its internal rom), execute some code that reads out the internal ROM and then build up a system that replicates the peripherals you lose when running in external mode. This is always complicated by toyota ordering custom version of the chip with extra timers and such, so you have little idea what's lost that requires replication.

[TheBeckoner]

Would you think something like a Ktag machine would be able to get any info off of it? I think the board has a BDM connection or something on it.

[Sparkie]

What's the board from specifically? And if it truly has some kind of interface port it may be programmable or at least readable - then you can disassemble it for the maps and mvoe them to something with more control.

[TheBeckoner]

What's the board from specifically? And if it truly has some kind of interface port it may be programmable or at least readable - then you can disassemble it for the maps and mvoe them to something with more control.

It's from a 99 Tacoma V6 automatic. It's currently tuned via a piggyback. I might can upload pictures, lemme see.

[TheBeckoner]

Alrighty here's a pic of the whole board

[Sparkie]

It looks a lot like the crystal is in the right place on the d151807 to conform to the qfp120 pinout in https://archive.org/details/tmp97c241/page/n1

Are you electrically inclined enough to check the power and ground pins on that chip to see if the rest of it works out? cause if it does we can brew up a board and dump its goodies..

you can also check to see if that 10 pin connector chases out to any of the serial port pins - which would indicate some kind of communications capacity.

[TheBeckoner]

It looks a lot like the crystal is in the right place on the d151807 to conform to the qfp120 pinout in https://archive.org/details/tmp97c241/page/n1

Are you electrically inclined enough to check the power and ground pins on that chip to see if the rest of it works out? cause if it does we can brew up a board and dump its goodies..

you can also check to see if that 10 pin connector chases out to any of the serial port pins - which would indicate some kind of communications capacity.

Once I find those pins I can probably perform some task if you told me what to do, but on my own I can probably only locate them.

In the meantime though I'll compare the serial ports on the chip to the traces from that port and see what I can find!