[Diy_efi] Re: Diy_efi digest, Vol 1 #229 - 14 msgs

[Bill Wiese]

Hi, folks...

>>> Re: New toyota TCCS info (Jerry Wills)

Just started lurking here. Cool stuff. 

Bit of my background: years ago I was involved with
tuning/chip reverse engineering for Dinan Engr. on Beemers
and some Japanese car stuff. Later on I worked at Motorola
for a bit, doing some 68K+TPU work, test platforms, etc.
before leaving to do something totally different (telecom
signal processing). Now I work for Philips (but not in the
microcontroller group!)

Now, **as I recall** (! it's been about 8+ years so memory a
bit foggy), when I looked at some Toyota ND TCCS units for
the lower-end engines (like 22R stuff on late 80s/early 90s
vehicles) the microcontrollers were custom jobs, mask ROM,
etc.  Didn't find a direct catalog correspondence but didn't
have access to Japanese databooks.  ND seems to sometimes
like Toshiba, sometimes Fujitsu chips - they have a line of 4
and 8 bitters (prob 16 bitters too) that are proprietary
(didn't really look like a 68xx, 63xx, 805x, etc). If you
look at the typeface/font on the chip numbering on some of
these, you'll see some look like Fujitsu silkscreening (or
however they mark 'em).
 
We decapped and photomicrographed the chips. IIRC, 4K of 8K
of ROM, etc. and I think there was some internal text/letter
indicating our Fuji guess was on the mark. There were, IIRC,
some other die #s on the chip but they had no sense to us
"outsiders".  I don't think there was a chance in hell these
chips could work w/external PROM unless perhaps I/O were to
be sacrificed.

We also took a look at an early 90s Lexus SC? LS? 400. The
typeface/fonts on the chips were different and smelled like
Toshibas.  Odd fine-pitch SDIP pkgs.  Indeed they were
Tosh/Moto 68xx (HC11??) with custom pinouts & I/O/timer
hardware.  Die # was EA41 which appeared to be fabbed by
Moto.  No pinouts available from any databook we could find.

Mazda, who also used ND ECUs, appeared to use of 68xx stuff
at least in the higher-end early-mid 90s stuff we were
looking at playing with.

We took a look for the helluvit at a Paseo and a Tercel
(can't remember if it was one or both or the same) and
surprisingly the ECU used DUAL 4-BIT CPUs!!!!

Honda/Acura transitioned in the early 90s from Oki 80C154s to
Oki 66K stuff.  Nice thing about many Hondas from 92? 93? up
was ECUs had an "upgrade ROM" space (w/space for LS373
address latch and a int/ext jumper) on PCB in case masked CPU
ROM was outdated.

The nicer thing about Oki 66Ks was that you could build a
test board to dump the ROM - no security bits, etc. (An Oki
EPROM burner head for the EPROM version of the 66K line
however would NOT read back the 66K ROM.)  Built a minimal
test jig, pulled EA pin to boot out of external ROM, used a
bit of code in 64K external ROM that started at $0000, jumped
to code up in $Fx00 upward. The code then pulled EA (I forget
the sense) to bank in *internal* ROM while code flow was
still in external ROM, and the internal ROM was fetched as
data and sent to PC over parallel port (didn't wanna mess
w/serial port setup, config, etc.)  Burned an external ROM,
and car ran fine.

We were able to do similar things with later 8051-family CPUs
too: later versions had MOVC code protection and also latched
/EA on reset. Doing no or incomplete reset (that is, RST only
held for one clock or less) got around this problem
w/different kinda code (lotsa NOPs followed by occ jumps to
our "get straight due to no reset/unknown state" code - then
bank in our dump code).

Lotsa fun, anyway....

Regards & happy tuning,
Bill Wiese
wmwiese at yahoo.com
San Mateo, CA [soon San Jose, CA]





 




=====
Bill Wiese
San Mateo, CA
bill at bwiese.org

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

_______________________________________________
Diy_efi mailing list
Diy_efi at diy-efi.org
http://www.diy-efi.org/mailman/listinfo/diy_efi