DSM/ECU/TMP76xxx MH6xxx FAQ
Q: "I have a non-eprom ECU with a TMP76xxx/MH6xxx, is it possible to read the internal ROM from it?"
A: Yes it is possible, it has even been done, I've done it.
Q: Can you then write that ROM code to an EPROM version of that ECU and use that?
A: This seems perfectly feasible, however is untested (AFAIK).
Q: Is there a pin that can be toggled which will trigger an internal ROM dump?
A: No, this has never been observed in this series of microprocessors.
Q: Can you pull the internal ROM while the MPU is still on the ECU PCB?
A: Short: No.
A: Long: Not without some effort. Such effort would consist of:
- ) Disabling/disconnecting external "watchdogs"/COP(Chip Operating Properly) which will reset the MPU automatically if code takes too long to execute/check in with the watchdog (might involve "pin lifting"), maybe possible in code
- ) Connecting to the serial pins and waiting for bytes to be dropped
- ) Setting the mode pins to "Mode 0" (probably involve "pin lifting")
- ) Getting external code loaded into the MPU to do the code dumping (hooking up an EPROM/EEPROM(equivalent) which also requires a support chip) this would probably require a full desolder in any case.
Q: Can I take an MPU off of a non-EPROM ECU, solder it to an ERPOM ECU, and the pull the internal ROM off that way?
A: You could, however the first three points of the long answer above still apply, and then you risk destroying a good EPROM ECU along with the risk taken desoldering the non-EPROM ECU anyway. Better to get a PCB made up of my design, desolder the MPU from the non-EPROM ECU, put it in a socket, read the code out, and solder it back. Or better yet get an SMD socket and socket the MPU.
Q: Can you under-clock the TMP76xxx/MH6xxx? If so, by how much?
A: Yes, you can underclock these MPUs (run them below the normal 12MHz). I've run them into the single Hertz, however it should be noted there seems to be limits as to how low the SCI(Serial Communications Interface) will operate correctly at lower frequencies (I've observed a lower limit of 24KHz using `/16` aka lowest SCI speed.
Q: Can you over-clock the TMP76xxx/MH6xxx? If so, by how much?
A: Yes, technically you can "overclock" them too, (run them above the normal 12MHz), however, not by much it seems. 13MHz is too much! I have tacked on a couple KHz though. Also, who knows what the operational limits of these chips were? Not us, there has never been a datasheet for these. Calling it "overclocking" is therefore based upon the assumption that they were run at their maximum rating(12MHz)
Q: Can you use the TMP76xxx/MH6xxx as a general purpose microprocessor?
A: Yes, with some nice timer functionality at that. It'd be a rather expensive choice however.
Q: Does TMP76xxx/MH6xxx have a bootloader?
A: Short: No.
A: Long: These MPUs do not use a bootloader as a matter of design. Even in implementation they never* use them. *Only once has there been what looks like a bootloader of sorts on the internal ROM of an MPU being used with external ROM (EPROM). It has yet to be discovered if it was used as part of normal operation (pretty unlikely), or if it was left over from testing(pretty likely). I've also written a proof of concept bootloader I use for testing.
Q: What is on the internal ROM of MPUs that are only used with external ROM?
A: Typically I've mostly seen ECU code. Once there was something bootloaderish found instead.
Q: Is the internal ROM of MPUs that are only used with external ROM the same as the code on the EPROM?
A: This needs to be tested. The version codes used on the EPROMs and the MPUs seem to always be different however. (Does this suggest that MPUs had general ECU code on them and EPROMs have tuned, engine specific code on them (in which case it is likely untestable because they would always be different) or did they just slap whatever overstock MPUs they had on EPROM ECUs?
Q: Do the "version codes" (usual 1-2 letters followed by 2-3 numbers with an occasional tailing letter) on the EPROMs and the ones on the MPU (TMP76xxxx-[AA###A]<--This part) correlate with each other?
A: I've always assumed so. They seem to always be the same size (12KB) and take up the same space (0xD000-0xFFFF) which is why full (32KB 0x8000-0xFFFF) binaries taken from EPROMs seem to have the first half 0xFF'd out. However, I have never found MPUs that have codes matching those found on EPROMs before. The Toshiba marked LCC I found[1] that had the same code as a Mitsubishi branded chip from an ECU produce matching binaries.