Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter

Engine Control Unit (ECU)
Reading Error Codes
Reverse Engineering
ROM images

Transmission Control Unit (TCU)
Reading Error Codes
Reverse Engineering
Power Mode
ROM images

Other Control Units
Air Conditioning Unit
4WS Control Unit
Cruise Control Unit

OBD2 Information
Select Monitor Cartridge

Links to other sites

Custom TCU Development


The ECU is made by JECS and based around the Mitsubishi M37791 CPU (7700 family). There is 32K of ROM and 1280 bytes of RAM. 16-bit values are stored in little-endian form.

The picture above shows a USA model ECU. You can see the upgrade socket and the tan reistor that you cut to enable the upgrade ROM. On the bottom left is a daughterboard containing the atmospheric pressure sensor. This daughterboard is absent on Japanese and European ECUs.

Memory Map

2000-2800Memory mapped IO (addresses 2000,2200,2400,2600,2800)
4000-411Funknown (ECU writes values here, but never reads)
8000-8FFFROM data
9000-FFB5ROM code
FFD0-FFFFInterrupt vectors

Disassembling the code

A similar CPU was used in some old arcade games and a suitable disassembler can be found amongst the source code of the MAME project. I couldn't get MAME to fully compile on my system, but after setting DEBUG=1 in the Makefile, the required object got built.

One of the difficulties of disassembling m7700 code is that there is an "M flag" that changes the instruction decoding at runtime. I wrote a program which loads the ECU ROM into memory and calls the MAME disassembler function. It makes two passes through the code. On the first pass, it stores the value of the M flag at every branch instruction. On the second pass, it sets the M flag correctly at each of the branch targets.

The 7700 simulator (PD77SIM) can be used to step through the code and see how it works. Its usefulness is limited because it does not simulate any of the other hardware in the ECU. I guess MAME can probably do the same thing.

Reference Material

I haven't been able to find a datasheet for the M37791 CPU, but the datasheets for other processors in the same family contain relevant information. The closest is probably the M37790.

M37791 Pinout
7700 Family Software Manual.pdf
M37700 Datasheet.pdf
M37790 Datasheet.pdf