Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Engine Control Unit (ECU)
Reading Error Codes
Transmission Control Unit (TCU)
Reading Error Codes
Other Control Units
Air Conditioning Unit 4WS Control Unit Cruise Control Unit
Select Monitor Cartridge
Links to other sites
Custom TCU Development
HardwareThe ECU is made by JECS and based around the Mitsubishi M37791 CPU (7700 family). There is 32K of ROM and 1280 bytes of RAM. 16-bit values are stored in little-endian form.
The picture above shows a USA model ECU. You can see the upgrade socket and the tan reistor that you cut to enable the upgrade ROM. On the bottom left is a daughterboard containing the atmospheric pressure sensor. This daughterboard is absent on Japanese and European ECUs.
Disassembling the code
A similar CPU was used in some old arcade games and a suitable disassembler can be found amongst the source code of the MAME project. I couldn't get MAME to fully compile on my system, but after setting DEBUG=1 in the Makefile, the required object got built.
One of the difficulties of disassembling m7700 code is that there is an "M flag" that changes the instruction decoding at runtime. I wrote a program which loads the ECU ROM into memory and calls the MAME disassembler function. It makes two passes through the code. On the first pass, it stores the value of the M flag at every branch instruction. On the second pass, it sets the M flag correctly at each of the branch targets.
The 7700 simulator (PD77SIM) can be used to step through the code and see how it works. Its usefulness is limited because it does not simulate any of the other hardware in the ECU. I guess MAME can probably do the same thing.Reference Material
I haven't been able to find a datasheet for the M37791 CPU, but the datasheets for other processors in the same family contain relevant information. The closest is probably the M37790.M37791 Pinout 7700 Family Software Manual.pdf