Funny adventures in electrical engineering

[TheBeckoner]

Ok so there's a possibility that the firstmost pin on the 10 pin connector goes to INT2/P72 but for the most part the others seem to go nowhere... 2 others seem to go to a power switch of some sort? (they seem to lead to a chip called SE191 which as best as I could find is some sort of power switching thing, but idk) P72 doesn't explicitly say serial anywhere but Im not familiar with the language used in the manual so I'm not sure.

[TheBeckoner]

Slight update. Some pins from the bottom seem to go to the unidentified chip, which is unfortunate because I have no clue what it actually is. I hope the maps aren't on it... Some pins seem to go through the middle of board the to somewhere as well or it seems that way using a flashlight.

[Sparkie]

So the typical toyota ecu from this era (well, more so earlier given my experience) is one microcontroller to run the engine, one microcontroller to run the transmission.

To validate some of this you can chase out the pins on the micro through some of the other components to the particular sensors and actuators on the engine. check the ecu pinout and find out what the injector and igniter outputs are, then follow them back (use a multimeter with a continuity beep). Inputs will likely be buffered by some resistors or an IC, outputs will be buffered by an IC or transistors. It helps the most if you're able to power up the computer on a desk and feed it some fake engine signals with a function generator, tracing out the inputs and outputs with an oscilloscope. You could also use the vehicle itself for this but thats significantly more cumbersome.


I recalled finding a subroutine once in these computers that read out an address given a request for one. that way they could build a scantool that just dumped data from the ecu. chances are that's what that port does.

[TheBeckoner]

Ok, that makes sense. The 9000 chip has a 16mhz crystal and the other chip has a 8mhz crystal, Im guessing the slower one runs the auto trans? I will check the ecu pinout and see what pins go where to confirm its the right chip though.

[disco_cat]

It's part of OBD specs that ecu could output particular address contents, but it works for restricted address range. It helps scan tool determine what data sets and active tests are supported by a particular ecu
Processor itself, on the other hand, can output its memory contents, but you have to run it from external memory first

[threepot]

Hello,

I have joined this forum as I have been looking at trying to achieve something with the Toyota engine controllers using the TMP97CW42AF, achieve what I don't know!

To be honest I do not have a great deal of experience with this sort of thing, but have managed to reverse engineer a board based on the ST10 / C167 micro platform enough to suit my needs.

As you guys already know its a LQFP120 TLCS-900 series, with 128k ROM and 6k RAM, and unfortunately it is a Masked ROM so no reflashing is possible.

I have a couple of spare control units, which are taken from 1999 to 2005 Toyota MR2 "Spyder" as you guys call them, here they are the "Roadster", running 1ZZ-FE.

I was hoping to use an external ROM, connected as per page 26 of the Toshiba TMP97C241 datasheet, with some little program that would read out the internal 128k ROM space, and spew it out of serial port 0 on pins 25 and 26.

Writing this program is currently beyond my means, but reworking the board to get this all jerry rigged up is well within my means.

I wonder if this assembly software project is something Sparkie or Disco_Cat can help with?

I have scopes, reworking gear, stereo microscope, and lots of experience doing this scale of surface mounted soldering. I also like a challenge that keeps me up till 4am.

With the original flash then the task of building a definitions file for the map data etc, and then either resolving or bypassing the check sum can progress.

I feel if I could get this to a point where we can dump the standard flashes, then I would source more units. If we had ROM dumps, then it would be a good start. And I think other people from the UK with MR2 and Celica would get drawn into this project.

The Honda scene has always benefited from the easily tweeked PGMFI ecu's which were easy to dump and chip with 27c eproms, while the Toyota community has been castrated with far more secure engine ecu's. I can't see why this can't be overcome.

[threepot]

This is the type of ECU I am messing with that is in the MR2 Roadster 1zz-fe part number 89661-17730 with cpu 151815-5431 97CW42AF-3448

I have checked the VSS and VCC pins according to the TMP97C241 datasheet with it desoldered, so it would seem like the datasheet must be similar for TMP97CW42AF but this device is C = Mask Rom / W = 128kb while the data sheet is for C = Mask Rom / 2 = 2kb thus the address data most likely be incorrect.

VDD = 2, 32, 62, 90, 177 = correct.
VSS = 20, 31, 61, 63, 91, 120 = correct
X1 + X2 = correct to 16mhz Crystal

[disco_cat]

I'm busy nearly 24/7 coding for my own projects

[Sparkie]

hey if you can make a board I can probably get some code out of it.

you say you found an assembler for the tlcs9000?

[MarkT]

So the typical toyota ecu from this era (well, more so earlier given my experience) is one microcontroller to run the engine, one microcontroller to run the transmission.

To validate some of this you can chase out the pins on the micro through some of the other components to the particular sensors and actuators on the engine. check the ecu pinout and find out what the injector and igniter outputs are, then follow them back (use a multimeter with a continuity beep). Inputs will likely be buffered by some resistors or an IC, outputs will be buffered by an IC or transistors. It helps the most if you're able to power up the computer on a desk and feed it some fake engine signals with a function generator, tracing out the inputs and outputs with an oscilloscope. You could also use the vehicle itself for this but thats significantly more cumbersome.


I recalled finding a subroutine once in these computers that read out an address given a request for one. that way they could build a scantool that just dumped data from the ecu. chances are that's what that port does.

Sparkie,,
Do you still have your break out board you guys had for the Supra CPU decode project ?
was hoping you might be able to pull the code from a 2000 1UZ Denso ECU, same board as your supra,
just a little different code for the 4.0 V8 VVT engine..
you also mentioned the 2 cpu's one for the engine and 1 for the auto trans, there is a nother 120 pin chip in the middle of the ECU,
show ESPC on it, any idea what this chip is ??

Mark..

[Sparkie]

Yeah I think everything is still within a few feet of my desk, we could work something out.

That espc is probably an IO expansion, I think I have one too in my pcm

[MarkT]

Yeah I think everything is still within a few feet of my desk, we could work something out.

That espc is probably an IO expansion, I think I have one too in my pcm

Sparkie.

If you want to contact me off the web site, email me at xxx
and see about working something out..

Mark