Introduction
Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping
Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images
Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images
Other Control Units
Air Conditioning Unit 4WS Control Unit Cruise Control Unit
OBD2 Information
Select Monitor Cartridge
Downloads
Links to other sites
Custom TCU Development
Hardware
The TCU is made by JECS and based around the Motorola MC68HC11 CPU. There is 16K of ROM and 512 bytes of RAM. 16-bit values are stored in big-endian form.There are several different types of 4EAT transmission fitted to the SVX. The TCU board is the same for each type, but components are populated differently and the firmware is different. It is important to use the correct TCU firmware for your transmission.
Memory Map
| 0000-01FF | RAM data |
| 0200-0FFF | unused |
| 1000-1079 | IO |
| 1500-7FFF | unused |
| 8000-BFFF | Mirror of ROM C000-FFFF (address line not used) |
| C000-D966 | ROM data |
| D967-F55D | ROM code |
| F55E-FFCB | unused |
| FFCC-FFFF | Interrupt vectors |
Disassembling the code
A disassembler for this CPU can be found as part of the MAME project. As I commented in the ECU section, I couldn't get MAME to fully compile on my system, but it gets far enough for the hc11dasm.o to be built.
The TCU code is easer to disassemble than the ECU code because there is no M flag to worry about. I wrote a program which loads the TCU ROM into memory and calls the MAME disassembler function. It makes two passes through the code. On the first pass, it locates the start of each subroutine. On the second pass, it outputs the disassembled code.
A simulator for this CPU is available and works well with the TCU code. MiniIDE + Wookie
Reference Material