ECU Code Disassembly

[jon.sole]

Just a heads up for anyone interested, but I've managed to pull the ROM code out of the ECU for the Rev 3 3S-GTE ECU.

There's almost no publicly available information on the MR2 ECU's, any information that has been discovered by other people has been kept secret >:( I'm intending to make all information I discover freely available!

The reader board I have should be able to read the code from all Toyota 64 pin processors, that includes the 3VZ-FE ECU!!

If anyone would like to help let me know and I can give you access to the project web-site.

Cheers,
Jon

[biteme]

Mate, that's awesome and totally in the MR2 way. Shame Jeremy pissed off taking all of his information with him.

He doesn't see MR2 owners ... I think he sees £'s

[Gary Symons]

I'm intending to make all information I discover freely available!

That is the TwoBrutal way! :clap:

[GaryA]

good on ya , will be very interesting to see how this goes .

[SlipSlide]

Excellent, good on yah.

[Paul Woods]

I'm intending to make all information I discover freely available!

As Gary said, that is exactly the very ethos behind this club, everything we discover we share, well done that man. :thumbsup:

[GregLeBon]

Jon, this is good stuff...!

Does this mean your going down the Jeremy route: ultimately aiming to alter the parameters / tune the stock ECU?

Are you able to reflash the ROM yet..?

or is that a "forthcoming attraction"?

IIRC, Jeremy added a little PCB to enable him to access/ alter the code...? :icon_conf

[jon.sole]

Does this mean your going down the Jeremy route: ultimately aiming to alter the parameters / tune the stock ECU?

Yep, that's the plan. I'm a very long way off being able to do that though!

Are you able to reflash the ROM yet..?

Kind of, to extract the contents of the ROM, the processor has to run code external to the chip. The reader board I have has an EEPROM chip on it with new code in. Currently this code just dumps out the ROM contents out to a serial port.

There is no way of replacing the ROM code in the processor, it was fixed during production of the chip, using an separate EEPROM or FLASH chip is the only way to change the code.

One drawback of running code from an external EEPROM is that it 16 of the IO pins on the processor are re-used to interface to the EEPROM, these IO pins are normally used to control various ECU functions.

So additional hardware will need to be designed to replicate the IO ports that have been lost.

IIRC, Jeremy added a little PCB to enable him to access/ alter the code...? :icon_conf

Yep, that's right, the PCB probably does everything I just described. I'd also expect that he also added some extra RAM, so that the fuelling, ignition maps, etc could be changed with the engine running.

Anyway, back to where I am at the moment lol
I'm currently trying to work out what the IO pins on the processors are responsible for, basically looking at each pin in turn with an oscilloscope whilst the engine is running! Once I've got a list of what pin does what, I can go back to the code and start making sense of it.

For example: Say Pin PB4 drives Injector 1, I can then search through looking for the code that changes PB4, tracing back through the code I should then be able to find that code that calculates the injector pulse width and somewhere nearby there should be a reference to the fuelling table :thumbsup:

Sounds simple in theory, but in practice it's probably not going to be so simple :sad:

[jon.sole]

A few maps to whet your appetite...

Fueling map?


Any guess what this map is for?


Boost target map?


All these maps come from just one of the processors, the first 2 maps are 24 x 12, there 3 or 4 more 3-D maps and a load of 2-D maps. The other processor has even more 3-D & 2-D maps, quite advanced for at 15-20 year old ECU design!

Cheers,
Jon

[jon.sole]

Does anyone have any idea what the second map I posted above is? Does it look like an ignition map of some kind?

If it is the ignition map, then it means all the important maps are in just one processor

It looks like one processor calculates the required fuelling, ignition timing, boost target etc and the other processor actually reads the engine sensors and drives the injectors, ignition coil, turbo VSV, ISCV etc... The two processors share data through a serial bus with a few other control signals.

All this means that remapping this ECU would only need a simpler PCB for one processor and not two as I originally thought! :mrgreen: