ECU Processor information needed

[Dramon]

The JDM TT ECU has two processors both labeled D15108-8921. The D151802 series processor is made by Dense, hence the D prefix and was used in all their cars during the late 80s early 90s. The prefix denotes the specific version of the chip however.

If anyone has or can find a spec sheet on this chip i'd be greatly appreciate. I can't seem to find anything.

[Bean]

The JDM TT ECU has two processors both labeled D15108-8921. The D151802 series processor is made by Dense, hence the D prefix and was used in all their cars during the late 80s early 90s. The prefix denotes the specific version of the chip however.

If anyone has or can find a spec sheet on this chip i'd be greatly appreciate. I can't seem to find anything.

Are these processors or are they EEPROM chips? I think they are memory actually. Soon as I get time I'm going to research the chips a little bit more. I've got access to a huge library at school.

[Dramon]

http://www.natesbox.com/gfx/HardwareDev/IMG_1741.JPG
Thats a pic of them on the soarer board. The 2JZ one is similar but uses different part numbers obviously. From what i've been able to gather, the processors on the Toyota ECU have a built in EPROM rather than an external one and all techtom stuff uses a daughterboard to externally dump the processor data into an external eprom which is then programmed.

[Dramon]

Found out some more info.

In that case only one of the MCUs needs to be swapped out for my board and it would work fine.

Taken from MR2oc.co.uk
"I have a V6 3VZFE Camry ECU here kindly donated by Paul Woods and that also has the extra MCU for the auto gearbox.

But I've removed the other main MCU and I was able to find all the usual fuel and ignition maps in the one MCU.

It has a slightly more powerful MCU chip but I'm pretty sure my board would work in the V6.

Your Soarer ECU has the more basic 7433 type chip so that one is already covered by my board (the 7433 series MCU is used in the rev1 3SGTE)

the 4 digit number after 7433 eg 7433-1511 shows the ROM firmware version burnt into the chip."

Also, possibly the second chip is for controlling the Automatic tranny, though I don't have a Manual ECU to verify. And maybe the smaller chip is for knock.

[Bean]

Yeah I just verified. They are embedded microcontrollers made by Intel. The D151802 number you gave me is cross referenced with BP87C51FC as a D151802-7154 variant.

I see by the pics that it is not a D151802 but a D151803. Which yields this: http://forums.openecu.org/viewtopic.php?p=5466&sid=07874dc9e42d61b5855b2bf33557dbe6

Seems it might be used in Subarus too; which means it may still be in use.

Whoa! This is obviously a chip used in the FD RX-7 as well. Here is a webpage describing memory locations and what they do vs the stock map input from the FD motor
http://page.freett.com/na6/N3A7.htm

I cant translate that page. Anyone?

[Dramon]

Yeah I just verified. They are embedded microcontrollers made by Intel. The D151802 number you gave me is cross referenced with BP87C51FC as a D151802-7154 variant.

I see by the pics that it is not a D151802 but a D151803. Which yields this: http://forums.openecu.org/viewtopic.php?p=5466&sid=07874dc9e42d61b5855b2bf33557dbe6

Seems it might be used in Subarus too; which means it may still be in use.

Thanks and good work.

If they're used in WRX's that might help us because the WRX ecu has been cracked already.

I found this though i'm sure you have just as much info as I do if not more.
http://www.cs.bilkent.edu.tr/~saranli/courses/cs431/documents/mcs51_guide.pdf

Taking what you gave me apparently the BP87C51FC is part of the mcs51 series microcontroller meaning that we may have just as much documentation as the Motorola HC11 guys (dsm ecu).

You sound like you have better access to info than I do, so feel free to post up any links you may find.

[Bean]

Dramon, that pic might be of a STI ecu.

This is the owner of the website here: http://forums.openecu.org/viewtopic.php?p=5466&sid=07874dc9e42d61b5855b2bf33557dbe6

We need to get the chip numbers off the USDM GE ECU.

[Dramon]

Oops my bad, yeah in my searching I got it mixed up with this one.

http://213.170.0.151:8080/~ian/soarer/1jz-auto-ecu.jpg

Thats the pic I meant to post.

Why we need the chip numbers from the USDM GE ECU? Mine is at home so I won't be able to check it out for a while, though I may have someone that has one he can check.

[Bean]

So thats a D151802-8330?

Maybe that Toyota MR2 guy got enough info about the 801 and the method Denso used to program their chips so we can get some info.

i've found several things of note:
http://www.cs.bilkent.edu.tr/~saranli/courses/cs431/documents/mcs51_guide.pdf
Thats the programmers guide to the MCS-51 (which is confirmed on what the 2jz has btw now)

I can most likely devise a chip daughterboard that will plug into the socket for this processor and then provide output data in a harness-type plug that we can use as a scan tool. I've got the programming and hardware knowledge to build a driver and interface with it; designing the PCB will be the real challenge.

This is going to be a ton of fun. There are also emulators out there too. Effectively, if we had a TON of time, we could rebuild the ECU logic from the ground up. Use a different operating system and everything if we wanted. But thats a bit too much work ;)

We need a way of copying directly everything in memory from the MCS-51 chip. Anyone care to count the amount of pins? Datasheet says its a 40pin

[Dramon]

Thisis the 1j ECU

I don't think that the 8320 or 8921 prefix really matters, just that it denotes what car its for and what data it has stored on it.

D151802-8320
7433-1511
1D2624

D151802-8350
7433-1513
1D2622

D151802-8320
572 182N
9113 Z02

I'll ask around and see if I can make any headway on how the info into memory, maybe i'll ask one of my professors.

[Bean]

It would involve a chip programmer for the MCS-51. Its an older processor so the university is bound to have one.

I've got a new professor for one of my labs itching to do a research/design project, so I'll ask him about this too

the 8320 means the Real Time OS that is running on the chip; i think. Intel/Atmel make these chips that Denso buys and then puts their ECU control Operating system on them. A manufacturer then contracts someone out to program the OS according to their specs for the kind of car they're going to use, etc.

[Dramon]

http://download.intel.com/design/mcs51/datashts/27211802.pdf

Its 64 pin and in the link above shows that maybe they do have a 64 pin MCS-51 packageI think? The only problem is its not a pinout.

I can't figure it out either, all I could find was 40pin.
http://download.intel.com/design/MCS51/datashts/27083803.pdf

What I think they might have done is used intel's 40pin PDIP as a core and then added another 24 pins for stuff they added and packaged it in as a d151802, which may explain why you don't see a single intel part number or marking on the chip.

This affects us but I didn't have time to read how.
http://www.intel.com/design/mcs51/technote/2112.htm

Heres a good link that explains the basics of the 87C51FC in more detail.

http://download.intel.com/design/MCS51/MANUALS/27238302.pdf

The 87 in the part number means this.

87- OTPROM - One Time Programmable ROM, non-erasable or UV Erasable EPROM


Main site:
http://www.intel.com/design/mcs51/docs_mcs51.htm


This may come in handy later. Not really sure what it does exactly though.

Intel Hex to Object File Converter
http://downloadcenter.intel.com/Detail_Desc.aspx?agr=N&ProductID=150&DwnldID=5931

One last thing subarus use the same MC as mitsubishi, not ours.

[Bean]

I think you're right, I cant find a DIP-64 version of the MCS-51 at all. I think the D151802 that is being autocross-referenced is not a Denso product at all but something else.

We need to find more hardware info on the DIP64 D151802

[Bean]

I'm pretty convinced that Denso didnt fab their own processor. Its someone else's and I want to find out who. I emailed them and asked :)

I think this is so because Denso is not a fab company and because there's NO information on this chip out there; so I dont think its a Denso-made chip.

[Bean]

:D
http://toyota.kgbconsulting.ca/mediawiki/index.php/3S-GTE_Technical_Info

I think this is the 801 chip; which most likely is identical save memory size. We need to ask the guy on the UK MR2 website. He hacked an 801 and would know the difference. This wiki is the most detailed info I've found thus far. If we could use a 68k emulator; we'd be in business.

[Dramon]

Thisis the 1j ECU

I don't think that the 8320 or 8921 prefix really matters, just that it denotes what car its for and what data it has stored on it.

D151802-8320
7433-1511
1D2624

D151802-8350
7433-1513
1D2622

D151802-8320
572 182N
9113 Z02

I'll ask around and see if I can make any headway on how the info into memory, maybe i'll ask one of my professors.

I just checked it again, the JDM TT Auto ECU has the following chips.

D151802-8932
5A41A-1-8579
JAPAN 1J1176

D151802-8921
5A41A-2-8080
JAPAN 1J1173

D151802-8941
572 220N
9142 Z04


All the ICs in the ECU all have denso part numbers so I can't find anything about them. Though there are two Toshiba ones that are 8 pin part # 74HC157AP

[Dramon]

http://www.aeu86.org/viewtopic/how-the-4a-ge-ecu-works/t/2490

Thats how the UK dude did it. The fact that he has been able to hack various toyota ECUs leads me to believe that youre probably right about them all being similar.

The hard part for us may be creation of the disassembler.

[Bean]

The assembler instruction set for these 8bit processors arent all that flashy. I'm sure it wont be all that hard.

[Bean]

These things look identical to Motorola 68k series processors which were VERY common back then. Same pin count and same pin layout.

I've also seen references to it being a 68k or being a knockoff 68k

[Dramon]

These things look identical to Motorola 68k series processors which were VERY common back then. Same pin count and same pin layout.

I've also seen references to it being a 68k or being a knockoff 68k

I think we may be back on the right track again. Though one thing I don't get, if the 6811 is so easily hacked then why is the Toyota ECU 'oh so hard' and different. If anything an older version of the 6811 should be at least simpler in design.

One thing that popped into my head. 6801...151801 6802....151802? Older skylines used a variant of the 6802 and 6801 on their cars and it sounds like every car manufacturer out there used a 6800 variant during that time period it sounds like. The only thing is a 6802 and 6801 would be pretty dated by the late 80s and early 90s and Toyota seems to do a fairly good job of staying on the curve.

[Bean]

Well the Toyota doesnt have a Motorola processor. I believe its a Chinese-made knockoff with a slightly different instruction set.

Its hard to hack compared to the others because those instructions are not published anywhere officially and there are no known development kits for them.

[Dramon]

where'd you find that site with the pinouts anyways?

Nvm about the dissasembler, hopefully its the same for our ECU. If it is then we already have this.

http://sourceforge.net/projects/toshi

With the ease though that the uk dude did things, i'm sure that its all fairly universal.

http://toyota.kgbconsulting.ca/mediawiki/index.php/3S-FE_ecu

That was neat too. I can't wait to actually start tearing into the ECU itself. Should I desolder the microchips to start out? And do you have an ECU you can play with?

[Bean]

I have no ECU to play with :) I was tempted to find one and take the chip to my microprocessor professor and see if he can figure out what it is.

For soem reason Igot confused about Toshiba part numbers, but we still dont know the brand of that chip. We're trying to find a Denso part number when we need a chip model.
I still think its going to be a chip available from 1990 from Motorola with a DIP-64 footprint. The language may be similar to that used on the 3S-GTE, but I dont think it has a DIP-64 socket. The newer chip may be a 16bit processor; but its probably an 8bit judging on the timeframe. Cheap 16bit CPUs didnt come out until the mid 90s I dont believe

[Bean]

I went to CPU-collection.de and found some interesting information.

I pulled up 1990 and Motorola. And look at what I found:
http://www.cpu-collection.de/?tn=0&l0=md&l1=1990&l2=Motorola
1990 was the year the 1jz was developed right?

;)

[Bean]

I cant believe I missed an important point:

We dont really need to know the assembly code of this unit do we? Unless reading the datalogging info requires it; which is possible. But we only need to download what is in memory on the mcu and then change the mode for it to read from external memory instead.

[Dramon]

http://kaele.com/~kashima/car/index-e.html

this is the site that they got the pinouts from I think.

And even if its based of that I don't think that motorola actually made it. I compared my chips to the ones in that link and they have slight differences, mostly the ridge on the top of the chip doesn't have a "step" to it, but instead is cut all the way through.

This guy is saying that the 64 one might be Toshiba not motorola based, at least for the 64 pin one. Though the toshiba may still be a 6800 clone. And going back on that further, from everything i've read about denso's other ECU's they love to use motorola architecture based chips.

I think we need to just start digging in instead of speculating.

[Dramon]

I cant believe I missed an important point:

We dont really need to know the assembly code of this unit do we? Unless reading the datalogging info requires it; which is possible. But we only need to download what is in memory on the mcu and then change the mode for it to read from external memory instead.
Actually I'm not totally sure but that sounds right. I guess as long as we can figure out the pinouts we're good to go, which i'm hoping are the same as they are on the 3s-gte one.

[Bean]

I have been digging :) I've got emails sent out to several companies asking questions and I've asked Qs to my professors at school; most of them dont have 68k experience.

It may be a Toshiba chip; who knows. But that 27Cxxxx is an EEPROM chip that was listed earlier. I've got my ECU on my nissan modded with a 27C1024 :)

[Bean]

GOT IT

http://www.google.com/translate?u=http%3A%2F%2Fkaele.com%2F%7Ekashima%2F car%2Ftoyota-r.html&langpair=ja%7Cen&hl=en&ie=UTF8

Its got the schematics I need. I'm going to start sourcing parts tonight.

[Dramon]

I have been digging :) I've got emails sent out to several companies asking questions and I've asked Qs to my professors at school; most of them dont have 68k experience.

It may be a Toshiba chip; who knows. But that 27Cxxxx is an EEPROM chip that was listed earlier. I've got my ECU on my nissan modded with a 27C1024 :)

Wait where is this 27Cxxxx youre talking about and where was it listed? I think I missed something.

If you haven't already read these.
http://www.mr2oc.com/showthread.php?t=176794&page=3&pp=30

http://www.mr2oc.com/showthread.php?t=210335&page=2&pp=30

http://www.mr2oc.com/showthread.php?t=238426&page=4&pp=30

Also here's the UK dude's site.

http://www.jmross.freeserve.co.uk/part2p2.html

Also, supposedly japan dude has some errors in his information.

[Bean]

I cant see the others; will have to login to mr2oc

The trouble with the UK guy is he NEVER gives out any information. Where are the tables located in memory? How are they stacked? etc

[Dramon]

I cant see the others; will have to login to mr2oc

The trouble with the UK guy is he NEVER gives out any information. Where are the tables located in memory? How are they stacked? etc

I emailed him and gave him a link to this section so i'm really hoping he'll respond with some help. It's worth registering btw, lots of good info. At this point i'm kinda stuck as to what to do, though..if you think it will help I can start mapping out the ECU.

[Bean]

Well there's not much you can do until you have the PCB that can get a memory dump from the chip.

If someone could get me the MAF airflow table that relates injector time vs voltage from the sensor; I could come up with a circuit that would take a linear airflow vs voltage graph (like a MAP sensor) and convert the numbers to the logarithmic scale that the MAF has. In effect, making a MAP ECU, but just the switch part ;) The other stuff could be done easily with voltage scaling of course. I guess more like a VPC then. But it'd be dirt cheap most likely.

[Dramon]

Well there's not much you can do until you have the PCB that can get a memory dump from the chip.

If someone could get me the MAF airflow table that relates injector time vs voltage from the sensor; I could come up with a circuit that would take a linear airflow vs voltage graph (like a MAP sensor) and convert the numbers to the logarithmic scale that the MAF has. In effect, making a MAP ECU, but just the switch part ;) The other stuff could be done easily with voltage scaling of course. I guess more like a VPC then. But it'd be dirt cheap most likely.

I was talking to one of my professors today and he was saying that during the late 80s/early 90s the only companies that really made microcontrollers were motorola or intel. It's obviously not an intel due to the 64DIP package, which leads into how he also said that packages were pretty universal and he doubted that DENSO would modify the chip enough to a) change pinouts or b)add pins to an existing chip. Which means it has to be 6800 series based (we pretty much established this already but its nice to hear it again.).

He also added that chip pinouts were fairly universal between packages. ie: 64DIPs and 40DIPs etc aren't going to differ very much from one another especially if it was made by the same manufacturer. I need to look at 6800 series chip pinouts and compare them to see how different they are. He suggested finding the clock pin and reset pin as those would be relatively easily to find. And then once you have those two, compare their location to different 6800 series chips. I'll try to trace them out myself but it may be hard because some of the pins end and reconnect underneath the chip itself.

Also I like your MAP ECU idea, except the only problem is we'd also have to figure out a way to change the input because ODB1 is Karmann Vortex and the input into the ECU is a frequency. At least I think it is, I can't remember if it does the conversion externally in the MAF, I may need to check that.

I don't know much about the PCB stuff though or where I would begin on building a PCB daughterboard to extract the ROM.

[Dramon]

my bad misread ur maf stuff

http://www.autoshop101.com/forms/h24.pdf

Thats the best I could do for the KvF maf.

[lobuxracer]

The Karmann vortex generator sends a frequency signal to the ECM per the documentation above, and per the New Car Features manual for the '93 Supras. It has a pullup resistor on the input and this input is fed to the analog interface board.

There are either two or three processors in the TT Supra. Two are used for engine control. The third is added for automatic transmission control. I researched these chips about 5 years ago, and unless I am terribly mistaken, they're of Hitachi origin and they're 16 bit, not 8 bit.

I have three turbo ECMs sitting on the shelf. One is a G-Force modded unit complete with daughterboards, another is an OBDII unit, and the third is stripped of its digital board and I am keeping it for analog board parts. I sent the original digital board without processors to someone in Texas who was trying to do the same thing you are.

The memory onboard is undoubtedly ROM, and it can't be read directly. This is one of the reasons Toyco's code has not been cracked yet. The other is no one seems to know what encryption they're using for their POST checksum calculations, so even if the code were immediately accessible, modifying it would take an encryption cracking effort. That might take a minute or two. :)

Anyway, I have access to some resources that sound useful to you guys. Let me know if I can help.

[Bean]

Well I'm not out there to modify the operating system itself, just the data within memory. I believe the OS is encrypted (I'd be suprised otherwise), but I dont think the memory data is. From what i've seen the Techtom units do the same thing we're trying to do; which is supplant the chip with a daughterboard that has the same or a very similar chip but accesses external memory instead. And routing the external memory to a flashable rom chip instead of an old EEPROM 27c256.

Are you sure that two are used for engine control? I've seen conflicting info about it. I know there are two; but I've seen docs where people only changed one; and the pics I've seen of the Techtom only replaces one, not both. But I might be looking at it wrong.

I think the rom can be read directly, because via the schematics in one of the previous posts, the guy has designed a PCB made for dumping data from that Toyota chip; and the pinouts on the chip are there too. And the UK guy has cracked an 801 chip on the early 90s 3s-gte which logically may be related very much to the 802.

I still may end up building the plug and play megasquirt though :)

[lobuxracer]

I'm 100% certain both ECUs are used for engine control. One has fuel maps, the other ignition timing. That's why G-Force modded units have two daughterboards, not one; one chip has fuel maps, the other has ignition timing maps. The chip in the daughterboards is identical to the OEM chip with the exception of the connection scheme. The daughterboards are socketed where the OEM chips are surface mount. See below:

http://www.clublexus.com/gallery/data//500/IMG_01551.JPG

http://www.clublexus.com/gallery/data//500/IMG_01581.JPG

This is the analog board, complete with barometric sensor:

http://www.clublexus.com/gallery/data//500/IMG_01604.JPG

This is the ECU chip:

http://www.clublexus.com/gallery/data//500/IMG_01571.JPG

This ECM was the most complex ECM Toyota ever built in 1993. G-Force, now Technosquare, used the Techtom daughterboards, and Techtom was used to program the EPROMs in these pictures.

Also worthy of note is this unused spot for a connector:

http://www.clublexus.com/gallery/data//500/IMG_01621.JPG

It's a 26 pin location, but its purpose isn't obvious. It may well be a window into monitoring, or it may just be there for production testing purposes.

[Bean]

It looks much like a conversion board like I've seen for other MCU testing. Takes something like a DIP64 socket and converts it into something entirely different.

Are those DIP40 chips EEPROM or flash roms? Looks like it says AT29C.... IIRC thats an Atmel flashable rom?

I wonder was a D151804 is. The rabbit hole goes even deeper it seems.
It doesnt appear that this board has an external data scrambler like some of the other Techtom stuff I have seen. Either it doesnt have one or its internal to that D151804; which if its a new chip; then thats entirely possible

[Dramon]

Well I'm not out there to modify the operating system itself, just the data within memory. I believe the OS is encrypted (I'd be suprised otherwise), but I dont think the memory data is. From what i've seen the Techtom units do the same thing we're trying to do; which is supplant the chip with a daughterboard that has the same or a very similar chip but accesses external memory instead. And routing the external memory to a flashable rom chip instead of an old EEPROM 27c256.

Are you sure that two are used for engine control? I've seen conflicting info about it. I know there are two; but I've seen docs where people only changed one; and the pics I've seen of the Techtom only replaces one, not both. But I might be looking at it wrong.

I think the rom can be read directly, because via the schematics in one of the previous posts, the guy has designed a PCB made for dumping data from that Toyota chip; and the pinouts on the chip are there too. And the UK guy has cracked an 801 chip on the early 90s 3s-gte which logically may be related very much to the 802.

I still may end up building the plug and play megasquirt though :)

The UK dude replied to my email.

I didn't get to play with the Supra ECU. I have an older Supra ECU which has the same MCU chip but that is from a 1990 car.

The pinouts are the same on all the 64pin chips AFAIK but there are different revisions of the 64pin chip, eg some have register changes, more RAM and more ROM.

I tend to ignore the misleading D15180x label on the chip but FWIW I have reversed all revisions D151801 through D151803. This covers both 42pin and 64pin versions from 1987 through 1997.

Do you know how the two MCU's interface with one another and what does what?

Depends on the ECU. Sometimes the extra MCU is for the auto gbox, sometimes both MCUs are bussed together to share the engine management. There's usually another smaller MCU for the knock sensor.

Here is a general overview into how to make a single 64pin MCU ECU reprogrammable. It's just an overview and it may or may not put you off....

1) The original 64pin MCU chip in the ECU contains all the program code and
maps within the chip.

2) This MCU chip can also be run in 'external memory mode'

3) The first step is to get the internal code/maps out of the MCU chip (so you can put it in the external memory)

4) Once you have this you design a board that uses the original MCU chip
reconfigured for external memory mode.

5) Here's where it gets tricky. When you put the MCU chip in external
memory mode it reassigns some of its 64 pins into multiplexed address lines and data
lines and R/W lines (to allow it to access the external memory) This means it LOSES the previous
ECU functions assoc with those pins. Those reassigned port pins used to provide
control lines for control of I/O devices in the ECU and sometimes for vital comms to other chips in the ECU.

Also there are internal MCU latch/control registers that get lost in ext memory mode and you have to recreate these in external hardware or the ECU will not run correctly.

You have to know what needs replacing and also how to recreate and address it such that the ECU hardware functions 100% as stock. I do all this with a special programmable logic chip.

6) This board then replaces the original MCU chip by plugging into the same connections as the original MCU but the ECU doesn't realise any difference and it will run exactly as standard (until you start
altering the program code/mapping)

So the basic reprog ROM board that replaces the original MCU chip will contain:

1) The original MCU chip in ext mem mode.
2) An external memory chip (FLASH/EPROM?) with all the code/maps
3) A custom logic chip that provides the multiplexing for
addressing the ext memory and ALSO the lost port pin functionality and ALSO
some associated MCU registers (and latches) that get lost when in ext mem mode.
After reading this then maybe instead of an external data 'scrambler' maybe the things we thought were for encryption were really for restoring those lost external memory mode functions.




Hey Lobux, what ECU are those pictures from anyways?

[lobuxracer]

Pics are from a G-Force modded '93 2JZ-GTE for 6 speed MkIV Supra. It worked in my car even though it's chipped for 720cc injectors with California 91 octane. It does not work in Georgia with 93 octane fuel minus all the oxygen enhancers used in CA. I bought it used for $300 from someone I've known a long time. It will work fine when I go single and put bigger injectors in the car. It runs sickeningly rich right now. Vf is stuck at 5V trying to correct.

[lobuxracer]

It looks much like a conversion board like I've seen for other MCU testing. Takes something like a DIP64 socket and converts it into something entirely different.

Are those DIP40 chips EEPROM or flash roms? Looks like it says AT29C.... IIRC thats an Atmel flashable rom?

I wonder was a D151804 is. The rabbit hole goes even deeper it seems.
It doesnt appear that this board has an external data scrambler like some of the other Techtom stuff I have seen. Either it doesnt have one or its internal to that D151804; which if its a new chip; then thats entirely possible

Yes, it's an Atmel 256k PROM. Not even EPROM or EEPROM. Just plain old PROM.

The original MCU sockets are 68 pin squares as well. They are not 64 pin DIP.

I also have an ECM from an '88 pickup - I think it's a Tacoma, but I'm not sure. I bought it from a junkyard hoping to find an injector driver transistor I could use on it, but no luck. It has a two 42 pin DIP chips with 151801-xxxx part numbers on them. Yes, I counted the pins three times to be sure I counted correctly as I've never seen a 42 pin DIP either.

Although it might be possible to get some assistance from our friend in the UK, I doubt his help will be all that helpful in some regards. It would also be very helpful at this point to have some inside photos of the 2JZ-GE ECMs to see if they're anything remotely like the 2JZ-GTE ECMs.

[chitwnsazn]

haha those through hole resistor parts are hillarious

[Bean]

I've got a bonus coming at work soon; and thus the debate becomes whether to buy the upgrade chips or the assembly kit for a megasquirt2 plus extra money leftover.

[NoLongerA13BFan]

Have you guys ever looked at the ECU for an Infiniti Q45? I know the early model cars (90-94) have had the ECUs cracked and you can get them with switchable maps. I am not sure if that is helpful at all but I figured it may help.

[Bean]

Unfortunately, the Q45 is an 8cyl motor. Making the Q45s system work on a 6cyl engine would most likely be pretty tough; it would require making major changes to the operating system on the ecu. Plus most of those hacks are still just using MAF. We'd like to do a map conversion.

[Dramon]

Unfortunately, the Q45 is an 8cyl motor. Making the Q45s system work on a 6cyl engine would most likely be pretty tough; it would require making major changes to the operating system on the ecu. Plus most of those hacks are still just using MAF. We'd like to do a map conversion.

Just a thought, with the JDM TT ECU you'd already be setup to run MAP and you'd have timing tables for boost, though, you would have to figure out the TT wiring on an SC. Though, the GE ECU may have tables yoiu can unlock that are based on manifold pressure to get around not having timing tables under boost.

What is timing based off of stock anyways? RPM and Throttle %? If its also based off of MAF voltage than it really wouldn't be that hard to tweak the tables to vary based on boost as well.

[NoLongerA13BFan]

Unfortunately, the Q45 is an 8cyl motor. Making the Q45s system work on a 6cyl engine would most likely be pretty tough; it would require making major changes to the operating system on the ecu. Plus most of those hacks are still just using MAF. We'd like to do a map conversion.
I didn't mean using the ECU itself but more the knowledge they have gained by cracking the ECU. Just a though though as the user selectable maps are a nice touch.

[Dramon]

I didn't mean using the ECU itself but more the knowledge they have gained by cracking the ECU. Just a though though as the user selectable maps are a nice touch.
Sadly the Toyota ECU's are much different than other ones so while the basics cross over, not much else does. We appreciate the help regardless and if you come across anything else don't hesistate to post it up!

[lobuxracer]

Just a thought, with the JDM TT ECU you'd already be setup to run MAP and you'd have timing tables for boost, though, you would have to figure out the TT wiring on an SC. Though, the GE ECU may have tables yoiu can unlock that are based on manifold pressure to get around not having timing tables under boost.

What is timing based off of stock anyways? RPM and Throttle %? If its also based off of MAF voltage than it really wouldn't be that hard to tweak the tables to vary based on boost as well.

TT timing maps are 3D - RPM, load, boost - and they have a weird lean spot at 4500 in the US models. They are 3D to compensate for the transition from single to twin turbo operation.

[Dramon]

TT timing maps are 3D - RPM, load, boost - and they have a weird lean spot at 4500 in the US models. They are 3D to compensate for the transition from single to twin turbo operation.
Oops, I meant the N/A timing maps.

[Bean]

Arent load and boost read as the same thing lobuxracer? They are on the the Nissan ECUs and all of the others that I've ever seen.

In a typical fuel and timing map you have 3 variables to make it 3D:
RPM value, Load Value (just a load, read as airflow), and the value at the particular point in the table. If you added the literal value of "boost" into the table, then you'd have a 4D map that would a lot harder to read :)

I do realize the TT USDM models have both a MAF and a pressure sensor; but the pressure sensor from what I know is used for boost cut instead, nothing actually in the fuel/ign map. On the JDM ECU, its a different story. I'm sure the tables are based on MAP voltage or something similar. To convert MAF to MAP in theory, you would have to convert the lookup table (if there is one) that the ECU has internally for the MAF voltage values to a linear map. It'd take mildly difficult math, but I'd bet I could whoop something out pretty quick if I had the info :)

On Nissan ECUs, they do exactly this, the MAF tables are read based upon MAF input voltage and then output a literal load value (I think in mm/HG). In fact most of the software that is free can change the MAF tables for you. I have mine changed to a Z32 MAF since thats what I'm using.

[Dramon]

Yeah I forgot that most engines with MAF's base things off of VE, I wasn't sure if timing was the same or different as fuel though.

[lobuxracer]

Arent load and boost read as the same thing lobuxracer? They are on the the Nissan ECUs and all of the others that I've ever seen.

In a typical fuel and timing map you have 3 variables to make it 3D:
RPM value, Load Value (just a load, read as airflow), and the value at the particular point in the table. If you added the literal value of "boost" into the table, then you'd have a 4D map that would a lot harder to read :)

I do realize the TT USDM models have both a MAF and a pressure sensor; but the pressure sensor from what I know is used for boost cut instead, nothing actually in the fuel/ign map. On the JDM ECU, its a different story. I'm sure the tables are based on MAP voltage or something similar. To convert MAF to MAP in theory, you would have to convert the lookup table (if there is one) that the ECU has internally for the MAF voltage values to a linear map. It'd take mildly difficult math, but I'd bet I could whoop something out pretty quick if I had the info :)

On Nissan ECUs, they do exactly this, the MAF tables are read based upon MAF input voltage and then output a literal load value (I think in mm/HG). In fact most of the software that is free can change the MAF tables for you. I have mine changed to a Z32 MAF since thats what I'm using.
Someone has led you astray on the turbo pressure sensor's function. This is not a Nissan. The turbo pressure sensor actually controls 6 features on the TT ECM, and if the MAF has a minor malfunction and sets DTC 31 (not major like forgetting to plug it in - AMHIK) the ECM will use the pressure sensor and do speed density.
DTC 31 failsafe - Volume of air flowing is measured by turbo pressure sensor to determine injection volume and ignition timing.
I wrote this a long time ago. (http://www.mkiv.com/techarticles/bcc/why_bcc/Why_the_GReddy_BCC.htm)
The turbo pressure sensor is used for six different functions by the ECU. The most noticeable is fuel cut for an overpressure condition which is 2.00 kg/cm2 absolute pressure, or 0.97 kg/cm2 gauge (28.45 psia, 13.75 psig). Fuel cut is an extreme measure invoked by the ECU when it detects boost over 2.00 kg/cm2 absolute, AND throttle position 20 degrees or more AND engine speed over 2400 rpm. It shuts down the engine until the boost drops back below the 2.00 kg/cm2 threshold, and lights up your MIL (malfunction indicator light). The other turbo pressure sensor functions are exhaust gas bypass valve control, idle speed anticipation, exhaust gas recirculation (EGR) control, fuel pump voltage selection, and evaporative emissions control.
There's also a schematic for a BCC-like circuit you can build yourself for about $5.
NOTE - The New Car Features for the 1993 Supra is undoubtedly the best source of design information and technical information about the cars - even better than the Repair Manual in many cases because it explains WHY they designed things a certain way. It should be a bible for anyone wanting to modify the cars because it allows the prospective modder to understand what Toyco was thinking when they did something a certain way.

Anyway, load != airflow in a Toyota ECM, load is calculated. According to the NCF: ESA (electronic spark advance) basic ignition advance uses the crankshaft position sensor (NE), throttle position sensor idle detect (IDL), mass airflow sensor (VG), vehicle speed sensor (SP1), and the A/C amplifier (A/C) for inputs to the ECM. The warm up correction feature uses IDL, VG, and engine coolant temp (THW) inputs. Overtemp correction uses VG and THW. Stable idling correction uses NE, IDL, THW, SP1, data link check connector (TE1), and A/C. Knock correction uses NE, IDL,VG, THW, KNK1, and KNK2 (knock sensors.) Finally, torque control correction uses NE, THW, and B+. There is a lot more than meets the eye with just spark control in a Toyco ECM. This is all very neatly displayed in a master table in the NCF which shows exactly what sensors are used for different ECM functions.

Finally, Reg Riemer, who has forgot more than I'll ever know about Toyotas, tells me the ignition map is a 3D map because it has to be to support the sequential turbo setup. I have few doubts about Reg's expertise or tech advice. He is an incredible resource.

[Bean]

No one has led me astray; I'm going by experience in what I've read and learned over the years. Obviously, I dont have access to the information you do.

I realize this is not a Nissan, but again, I go by actual modding experience. There is no pressure sensor available on same-era Nissan motors; its all calculated load.

How does load not equal airflow? Thats exactly what it is when it comes down to it. I think you meant there wasnt a direct transfer from one to the other. And I may have simplified it a bit in the Nissan case since it does have other variables besides just input voltage; intake temps make a difference too I believe, along with water temp, knock sensor input, etc. But it essentially takes inputs from the sensors and uses the load value in a 3D ignition/fuel table.

Which I'm sure the GE does the same thing or something very similar as you have described. I can't see a 2D ignition map being a reality on these cars. Load and rpm are obviously both having an impact on the timing values when driving down the road in a stock GE; that makes it a 3D ignition map.
x = rpm, y = load, f(x,y) = fuel adj from stoich?/ign advance

Someone has led you astray on the turbo pressure sensor's function. This is not a Nissan. The turbo pressure sensor actually controls 6 features on the TT ECM, and if the MAF has a minor malfunction and sets DTC 31 (not major like forgetting to plug it in - AMHIK) the ECM will use the pressure sensor and do speed density.

I wrote this a long time ago. (http://www.mkiv.com/techarticles/bcc/why_bcc/Why_the_GReddy_BCC.htm)

There's also a schematic for a BCC-like circuit you can build yourself for about $5.
NOTE - The New Car Features for the 1993 Supra is undoubtedly the best source of design information and technical information about the cars - even better than the Repair Manual in many cases because it explains WHY they designed things a certain way. It should be a bible for anyone wanting to modify the cars because it allows the prospective modder to understand what Toyco was thinking when they did something a certain way.

Anyway, load != airflow in a Toyota ECM, load is calculated. According to the NCF: ESA (electronic spark advance) basic ignition advance uses the crankshaft position sensor (NE), throttle position sensor idle detect (IDL), mass airflow sensor (VG), vehicle speed sensor (SP1), and the A/C amplifier (A/C) for inputs to the ECM. The warm up correction feature uses IDL, VG, and engine coolant temp (THW) inputs. Overtemp correction uses VG and THW. Stable idling correction uses NE, IDL, THW, SP1, data link check connector (TE1), and A/C. Knock correction uses NE, IDL,VG, THW, KNK1, and KNK2 (knock sensors.) Finally, torque control correction uses NE, THW, and B+. There is a lot more than meets the eye with just spark control in a Toyco ECM. This is all very neatly displayed in a master table in the NCF which shows exactly what sensors are used for different ECM functions.

Finally, Reg Riemer, who has forgot more than I'll ever know about Toyotas, tells me the ignition map is a 3D map because it has to be to support the sequential turbo setup. I have few doubts about Reg's expertise or tech advice. He is an incredible resource.

[StarletGTT]

Im sure you guys have checked this page out but here goes

www.openecu.org

[nate]

I just read the entire thread. A friend pointed me here and I see you guys even linked to one of the ECU pics on my website ealier in this thread. It is great to see other people looking into this as I have been for quite some time. The datasheets posted are the most info I have seen on the proc.

From what I have gathered, this is the best way to attack this thing:

1) Determine how to enable the external EEPROM mode on the proc.

2) Dump the prom inside the proc

3) Build a daughterboard, burn said prom dump onto a EEPROM and as long as everything is right we should end up with a car that runs bone stock on the external EEPROM we have added.

4) Once we have this working smoothly we can go one of two routes; a full fledged dissassembly or the use of a device like Moates.net Ostrich2. The latest firmware he has released allows for address tracing, and evn cooler stuff like selective address tracing. I think using this method should allow us to figure out the basics like rev limits, fuel cut location, fuel/timing maps, VE tables ect ect...


If you guys are really serious about this, I would be willing to throw a WIKI online so we can collaborate all of our information and hopefully crack this baby wide open!

[Dramon]

I just read the entire thread. A friend pointed me here and I see you guys even linked to one of the ECU pics on my website ealier in this thread. It is great to see other people looking into this as I have been for quite some time. The datasheets posted are the most info I have seen on the proc.

From what I have gathered, this is the best way to attack this thing:

1) Determine how to enable the external EEPROM mode on the proc.

2) Dump the prom inside the proc

3) Build a daughterboard, burn said prom dump onto a EEPROM and as long as everything is right we should end up with a car that runs bone stock on the external EEPROM we have added.

4) Once we have this working smoothly we can go one of two routes; a full fledged dissassembly or the use of a device like Moates.net Ostrich2. The latest firmware he has released allows for address tracing, and evn cooler stuff like selective address tracing. I think using this method should allow us to figure out the basics like rev limits, fuel cut location, fuel/timing maps, VE tables ect ect...


If you guys are really serious about this, I would be willing to throw a WIKI online so we can collaborate all of our information and hopefully crack this baby wide open!

What was your website that we linked from?

[nate]

http://www.natesbox.com/gfx/HardwareDev/IMG_1741.JPG
Thats a pic of them on the soarer board. The 2JZ one is similar but uses different part numbers obviously. From what i've been able to gather, the processors on the Toyota ECU have a built in EPROM rather than an external one and all techtom stuff uses a daughterboard to externally dump the processor data into an external eprom which is then programmed.

Thats the one. The pic was from a 1jz-gte auto ecu if I remember correctly. I have lots of other data and pictures that I have been collecting over the past few years on this very topic...

[Dramon]

If you guys are really serious about this, I would be willing to throw a WIKI online so we can collaborate all of our information and hopefully crack this baby wide open!

Sounds good. If you could post up all the stuff you've picked up over the years in there and in this section that'd be great.

[Dramon]

I was talking to oen of my friends the other night and he mentioned that there is a guy on SF that has cracked the Supra ECU. He's from Canada. Has anyone else heard of him or know what i'm talking about?

[IS300GTE]

What happened to this thread and the effort going into it?

[SCoupe TT]

I came across this F.S. Link in the SupraForums that describes an Upgraded OEM 2jzgte OBD1 ECU this way:

"Upgraded stock ecu, Obd1 6speed Purchased from Reg Reimer. Was used on his one lap car. Has rev limit removed, speed cut removed. boost cut removed. Added timing below 4K to help spool, Fuel mods done to remove obd1 lean spot. $600 + shipping."

Link here: http://www.supraforums.com/forum/showthread.php?t=500561&highlight=obd1+lap

I've seen this car during an HPDE day it was a very potent MKIV. The owner is legit, known and trustworthy.

So is this evidence that this ecu has been cracked??

[Bean]

It has a techtom. I believe its about $750 for a GTE techtom install kit which doesnt include the software to tune it with. I can't remember

Here's the pdfs i got for the techtom back when looking at it.

When it comes down to it; that kind of cash isnt so economical.