Page 11 of 11 FirstFirst ... 34567891011
Results 201 to 208 of 208

Thread: Funny adventures in electrical engineering

  1. #201
    Join Date
    Jun 2019
    Location
    Houston
    Posts
    9
    Ok so there's a possibility that the firstmost pin on the 10 pin connector goes to INT2/P72 but for the most part the others seem to go nowhere... 2 others seem to go to a power switch of some sort? (they seem to lead to a chip called SE191 which as best as I could find is some sort of power switching thing, but idk) P72 doesn't explicitly say serial anywhere but Im not familiar with the language used in the manual so I'm not sure.

  2. #202
    Join Date
    Jun 2019
    Location
    Houston
    Posts
    9
    Slight update. Some pins from the bottom seem to go to the unidentified chip, which is unfortunate because I have no clue what it actually is. I hope the maps aren't on it... Some pins seem to go through the middle of board the to somewhere as well or it seems that way using a flashlight.

  3. #203
    Join Date
    Nov 2012
    Location
    Brampton, Ontario
    Posts
    1,487
    So the typical toyota ecu from this era (well, more so earlier given my experience) is one microcontroller to run the engine, one microcontroller to run the transmission.

    To validate some of this you can chase out the pins on the micro through some of the other components to the particular sensors and actuators on the engine. check the ecu pinout and find out what the injector and igniter outputs are, then follow them back (use a multimeter with a continuity beep). Inputs will likely be buffered by some resistors or an IC, outputs will be buffered by an IC or transistors. It helps the most if you're able to power up the computer on a desk and feed it some fake engine signals with a function generator, tracing out the inputs and outputs with an oscilloscope. You could also use the vehicle itself for this but thats significantly more cumbersome.


    I recalled finding a subroutine once in these computers that read out an address given a request for one. that way they could build a scantool that just dumped data from the ecu. chances are that's what that port does.

  4. #204
    Join Date
    Jun 2019
    Location
    Houston
    Posts
    9
    Ok, that makes sense. The 9000 chip has a 16mhz crystal and the other chip has a 8mhz crystal, Im guessing the slower one runs the auto trans? I will check the ecu pinout and see what pins go where to confirm its the right chip though.

  5. #205
    Join Date
    Jan 2016
    Location
    Russia
    Posts
    21
    It's part of OBD specs that ecu could output particular address contents, but it works for restricted address range. It helps scan tool determine what data sets and active tests are supported by a particular ecu
    Processor itself, on the other hand, can output its memory contents, but you have to run it from external memory first

  6. #206
    Join Date
    Jul 2019
    Location
    Crewe, UK
    Posts
    2
    Hello,

    I have joined this forum as I have been looking at trying to achieve something with the Toyota engine controllers using the TMP97CW42AF, achieve what I don't know!

    To be honest I do not have a great deal of experience with this sort of thing, but have managed to reverse engineer a board based on the ST10 / C167 micro platform enough to suit my needs.

    As you guys already know its a LQFP120 TLCS-900 series, with 128k ROM and 6k RAM, and unfortunately it is a Masked ROM so no reflashing is possible.

    I have a couple of spare control units, which are taken from 1999 to 2005 Toyota MR2 "Spyder" as you guys call them, here they are the "Roadster", running 1ZZ-FE.

    I was hoping to use an external ROM, connected as per page 26 of the Toshiba TMP97C241 datasheet, with some little program that would read out the internal 128k ROM space, and spew it out of serial port 0 on pins 25 and 26.

    Writing this program is currently beyond my means, but reworking the board to get this all jerry rigged up is well within my means.

    I wonder if this assembly software project is something Sparkie or Disco_Cat can help with?

    I have scopes, reworking gear, stereo microscope, and lots of experience doing this scale of surface mounted soldering. I also like a challenge that keeps me up till 4am.

    With the original flash then the task of building a definitions file for the map data etc, and then either resolving or bypassing the check sum can progress.

    I feel if I could get this to a point where we can dump the standard flashes, then I would source more units. If we had ROM dumps, then it would be a good start. And I think other people from the UK with MR2 and Celica would get drawn into this project.

    The Honda scene has always benefited from the easily tweeked PGMFI ecu's which were easy to dump and chip with 27c eproms, while the Toyota community has been castrated with far more secure engine ecu's. I can't see why this can't be overcome.
    Last edited by threepot; 07-16-2019 at 04:47 PM.

  7. #207
    Join Date
    Jul 2019
    Location
    Crewe, UK
    Posts
    2
    This is the type of ECU I am messing with that is in the MR2 Roadster 1zz-fe part number 89661-17730 with cpu 151815-5431 97CW42AF-3448

    I have checked the VSS and VCC pins according to the TMP97C241 datasheet with it desoldered, so it would seem like the datasheet must be similar for TMP97CW42AF but this device is C = Mask Rom / W = 128kb while the data sheet is for C = Mask Rom / 2 = 2kb thus the address data most likely be incorrect.

    VDD = 2, 32, 62, 90, 177 = correct.
    VSS = 20, 31, 61, 63, 91, 120 = correct
    X1 + X2 = correct to 16mhz Crystal

    Click image for larger version. 

Name:	20190716_235523.jpg 
Views:	2 
Size:	70.9 KB 
ID:	15814
    Click image for larger version. 

Name:	20190716_235757.jpg 
Views:	1 
Size:	188.4 KB 
ID:	15815
    Click image for larger version. 

Name:	20190716_235542small.jpg 
Views:	1 
Size:	222.2 KB 
ID:	15816
    Click image for larger version. 

Name:	20190717_000328small.jpg 
Views:	3 
Size:	141.8 KB 
ID:	15817

  8. #208
    Join Date
    Jan 2016
    Location
    Russia
    Posts
    21
    I'm busy nearly 24/7 coding for my own projects

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •