TCCS 1G-GT ECU Analysis

[timbosaurus]

Can do. Leaving on 2 weeks holidays though, so might not get a chance till I come back.

[toyoda]

Hi,

Love your work, too electronic for me - but does this help :


[IMG][/IMG]

[IMG][/IMG]

[IMG][/IMG]

[IMG][/IMG]

[IMG][/IMG]

[IMG][/IMG]

Unsure which model Supra it is for but is Turbo ATM STD Map.

Might give you some ideas .


Toyoda

[SumKid]

I have a mines chiped ga70 1ggt m/t ecu if you want any numbers or photo's of it, I dont really know what im looking at but might be helpful? haha

[timbosaurus]

What does the mines give you?

I assume:
- Removes boost (airflow) cut?
- Is redline factory?
- Does it give better AFR's (not hard!)?

Would be very interesting to see the hex compares between the two.

[Rosie]

Hey AUTO hat some indepth and lengthy work you've been putting in there,

whats your aim when you reach the end of the research?

Just interested in where your headed, love the 1g more and more , then hate it every now and then, haha.

[auto351]

I have a mines chiped ga70 1ggt m/t ecu if you want any numbers or photo's of it, I dont really know what im looking at but might be helpful? haha

These have EPROMs correct?
is it an easy task to read the data from them?

Interesting stuff, I had noticed some progress on this on other forums so am keen to give it a go myself.

GX81 1G-GZE A/T Gen 3 - Toyota 89661-22300, 175000-1751 12V (26P 16P 22P Plug)
CPU chip P/N: D151801-8490, 7433-1144
Auto chip P/N: D151801-8480, 7616-2046

What else were you after?

the last 4 number after the 7433-XXXX indicate this is different to the the 1G-GT,
do the 1G-GZ had a coil pack ?

whats your aim when you reach the end of the research?
.

The aim is the same a the Supra forum, the ability to tune the ECU (real-time).
& real-time data logging.

I know you can get an after market ECU but I think this would be a much better option when it becomes available.

I an only looking at the 1G-GT Gen3 ECU at this stage as it will be a simple conversion from the 7M.
The Gen1 uses the smaller 42 pin CPU im not sure how hard that would be to change over.

[big_zop]

Yeah, the 1G-GZE comes with coil packs instead of a distributor on all other 1Gs.

[SumKid]

What does the mines give you?

I dont really know but i asume what you have said, i have a stock ecu in the car, i was just given the Mines one when i bought it. Ive been trying to find information on it but its really hard, even the Mines website doesnt have anything that I can see.

These have EPROMs correct?
is it an easy task to read the data from them?

Sorry I dont know what EPROMs are, or how im going to read them

Cheers Seb

[auto351]

Hi,

Love your work, too electronic for me - but does this help :
Unsure which model Supra it is for but is Turbo ATM STD Map.

Might give you some ideas .


Toyoda

I have a mines chiped ga70 1ggt m/t ecu if you want any numbers or photo's of it, I dont really know what im looking at but might be helpful? haha

Guy , if these ECU are not in use at the current time, I would like a closer look and dump the data to see what is different, the mines unit is of most interest,

toyoda: most likle form an 7M supra, but want to see the code also
PM sent.

[auto351]

Just posting up some picture which shows the same CPU board used with two different companies.
Even the EPROM Checksum is the same, serial #91678 & #91137





we will be getting a dump of the EPROM and hosting the file if anyone want to have a look, may main concern here is the prom are coded, keeping in mind this company reversed engineered this product so they don’t want anyone doing the same to their work.
At least it a Gen3 ECU

One the Toyota ECU
I was tracing tracks with a multi meter and was slow going so I’m waiting for some test gear and trying a different approach.

Here are some tricks the programmers at Toyota use to save memory & making disassembly a bit trick for first timers, and they managed to save 1Byte.

To do this normally the CMP (compare 3 bytes) would be replaced by a BRA (branch always 2 bytes) instruction.
The CMP instruction subtracts the word in byte2 + byte3 from the X register and set the flags, nothing else.
So if we enter at 0xFF2Eh we load the accumulator next instruction at 0xFF30h is the compare (which is a 3 byte instruction and contains the ld a, instruction) effectively skipping over the hidden load instruction and the program continues at 0xFF33h.

If we jump in at FF31 then we perform the hidden load instruction and the program continues at 0xFF33h.

Expanded disassembly
ROM:FF2E ; __RESET+5BD p ...
ROM:FF2E ld a, $5Bh
ROM:FF2E ; ---------------------------------------------------------------------------
ROM:FF30 .db 8Ch ; This CMP is used to jump over the second ld a,
ROM:FF30 ; if the program calls FF33 then accumulator would
ROM:FF30 ; have been loaded before the call.
ROM:FF30 ; these two accumulator load above
ROM:FF30 ; must be common load registers
ROM:FF30 ; this saves
ROM:FF30 ; if jump to FF2E a = $5Bh
ROM:FF30 ; if jump to FF31 a = $65h
ROM:FF30 ;
ROM:FF30 ; Again 8C is a null instruction
ROM:FF30 ; if FF30 called the instruction at FF31 is skipped
ROM:FF31 ; ---------------------------------------------------------------------------
ROM:FF31 ld a, $65h ; CODE XREF: __RESET+1DD p
ROM:FF31 ; __RESET:loc_D82C p ...
ROM:FF33
ROM:FF33 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
ROM:FF33
ROM:FF33
ROM:FF33 sub_FF33: ; CODE XREF: sub_D02D+5 p
ROM:FF33 ; __RESET+1C2 p ...
ROM:FF33 cmp a, y + 00h ; branch If rA > x(0) of map(x,y) record
ROM:FF35 Match to (x) is to first or last map record
ROM:FF35 bgt 0FF3Ch
ROM:FF37

Original disassembly

ROM:FF2E loc_FF2E: ; CODE XREF: sub_D1A6+3 p
ROM:FF2E ; __RESET+5BD p ...
ROM:FF2E ld a, $5Bh
ROM:FF30 cmp x, #0DA65h ; CODE XREF: __RESET+1DD p
ROM:FF30 ; __RESET:loc_D82C p ...
ROM:FF33
ROM:FF33 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
ROM:FF33
ROM:FF33
ROM:FF33 sub_FF33: ; CODE XREF: sub_D02D+5 p
ROM:FF33 ; __RESET+1C2 p ...
ROM:FF33 cmp a, y + 00h ; branch If rA > x(0) of map(x,y) record
ROM:FF35 Match to (x) is to first or last map record

[big_zop]

That is some great work there and look forward to trying to apply it to my ECUs


On that note, I have now aquire 2 spares for me to work on and here are the specs:

GX81-1140099 (Jun 90) 1G-GZE A/T Gen 3
Toyota 89661-22300, 175000-1753 12V (26P 16P 22P Plug)
CPU chip P/N: D151802-1860, 7433-1248
Auto chip P/N: D151801-8480, 7616-2046

GX81-0008768 (Dec 88) 1G-GZE A/T Gen 3
Toyota 89661-22300, 175000-1751 12V (26P 16P 22P Plug)
CPU chip P/N: D151801-8490,7433-1144
Auto chip P/N: D151801-8480, 7616-2046

The latter one matches my original ECU perfectly so I will start with that, but for now its time to do a lot of research before i fire up a soldering iron.

[auto351]

just take your time if when you desolder the CPU chip, some of them have glue under the CPU making it hard to remove


I have just uploaded the ida 4.9 free for editing the code file.


http://cid-a253e0b7453f4772.skydrive.../idafree49.exe

The Toshiba module, just follow the readme.



http://cid-a253e0b7453f4772.skydrive...ensoModule.zip


I have included the project file,

http://cid-a253e0b7453f4772.skydrive...c/1ggteat2.idb

[auto351]

Just commented the Read_RPM code section (0xF14Bh) its almost identical to the 7M coding,, one differances being the 7M has a jump for A/T where the 1G hasn't.
This is another point for 1G-GTE A/T ECU performed the same as 1G-GTE M/T ECU.

ECU performance the same = 2 v M/T better performance = 0

I have updated the above project file and added the lst file here for quick access.

[auto351]

http://www.supramania.com/forums/sho...nalysis/page24

I have been following the progress on the Supra forum and looks like the board is close to release,

With work and other commitments decoding have been slow, with the board release drawing closer I am continuing the analysis of the ECU.

I would like to get a mines 1G ECU so I can extract the changes made fast tracking some of the decoding, if anyone has one handy please let me know.



Manuel

[auto351]

The ECU boards have arrived in the US they are getting one assembled & tested.
Here it is fitted to the ECU notice the USB port.




still dont know any costs,