CPU Technical Info
Contents |
Toyota ECU Microcontroller
This document is a collection of info about custom microcontrollers used in Toyota ECUs for 3S-GTE engines and likely others as well. They are somewhat similar to 6800 CPUs.
Package and Pins
It seems there are two package options for the main controller
Operating Modes
There are seven operating modes. Initial operating mode, MODE2 or MODE7, can be selected with I/E pin. Under program control any mode can be selected by writing to OMODE register.
|
Mode |
MD2 |
MD1 |
MD0 |
ROM |
RAM |
Interrupt vector |
Comments |
|---|---|---|---|---|---|---|---|
|
7 |
1 |
1 |
1 |
Int. |
Int. |
Int. |
Single chip mode |
|
6 |
1 |
1 |
0 |
Int. |
Int. |
Int. |
As for access to Port B register as for external treatment Port A only Output setting bit part of DDRA address output. Area between internal RAM and ROM generates external accesses. |
|
5 |
1 |
0 |
1 |
Int. |
Int. |
Int. |
Same as MODE6 |
|
4 |
1 |
0 |
0 |
Invalid |
Int. |
Int. |
Single chip static test mode |
|
3 |
0 |
1 |
1 |
Ext |
Ext. |
Ext. |
External Port A, both B registers |
|
2 |
0 |
1 |
0 |
Ext |
Int. |
Ext. |
External Port A, both B registers |
|
1 |
0 |
0 |
1 |
Int. |
Int. |
Ext. |
External Port A, both B registers |
|
0 |
0 |
0 |
0 |
Int. |
Int. |
Int. |
External Port A, both B registers |
Memory Map
There is 12KB of internal ROM and 384 byte of internal RAM. Mapping of internal RAM and ROM into the address space depends on operating mode. The 0xffde - the 0xffff are the vector area, the reset vector 0xfffe (the MSB) the 0xffff (the LSB) contents are set by the PC at the time of CPU reset and execution is started.
Mode 2
|
0x0000 |
I/O area |
|
0x0030 |
External memory |
|
0x0040 |
Built-in RAM |
|
0x0100 |
External memory |
|
0xffde |
Vector area |
|
0xfffe |
Reset vector (2 byte) |
Mode 7
|
0x0000 |
I/O area |
|
0x0030 |
Unused |
|
0x0040 |
Built-in RAM |
|
0x01c0 |
Unused |
|
0xd000 |
Built-in ROM |
|
0xffde |
Vector area |
|
0xfffe |
Reset vector (2 byte) |
I/O registers
Peripheral I/O registers are mapped to addresses 0x0000 – 0x002f. When operating in external modes (like MODE2) PORT A and PORT B can't be used, because those pins are occupied by the memory bus. Access to registers related to PORTA and PORTB go off chip, so it is possible to emulate PORTA and PORTB with external circuitry.
|
Address |
Abbreviation |
Function |
|
0x00 |
DDRA |
Port A input/output direction designated |
|
0x01 |
DDRB |
Port B input/output direction designated |
|
0x02 |
WDC |
watch dog timer |
|
0x03 |
TIMER3 |
timer LSB (bit0 - bit2) |
|
0x04 |
TIMER |
timer MSB (bit11 - bit18) |
|
0x05 |
TIMERL |
timer LSB (bit3 - bit10) |
|
0x06 |
SIDR |
(S ODR) serial data |
|
0x07 |
SMR |
/S IR serial controller control |
|
0x08 |
CPR0 |
timer comparison # 0 MSB |
|
0x09 |
CPR0L |
timer comparisons # 0 LSB |
|
0x0a |
CPR1 |
timer comparisons # 1 MSB |
|
0x0b |
CPR1L |
timer comparison # 1 LSB |
|
0x0c |
CPR2 |
timer comparison # 2 MSB |
|
0x0d |
CPR2L |
timer comparison # 2 LSB |
|
0x0e |
CPR3 |
timer comparisons # 3 MSB |
|
0x0f |
CPR3L |
timer comparisons # 3 LSB |
|
0x10 |
ASR0P |
ASR0 rising edge counter value MSB |
|
0x11 |
ASR0PL |
ASR0 rising edge counter value LSB |
|
0x12 |
ASR0N |
ASR0 falling edge counter value MSB |
|
0x13 |
ASR0NL |
ASR0 falling edge counter value LSB |
|
0x14 |
ASR1P |
ASR1 rising edge counter value MSB |
|
0x15 |
ASR1PL |
ASR1 rising edge counter value LSB |
|
0x16 |
ASR1N |
ASR1 falling edge counter value MSB |
|
0x17 |
ASR1NL |
ASR1 falling edge counter value LSB |
|
0x18 |
ASR2 |
ASR2 edge counter value MSB |
|
0x19 |
ASR2L |
ASR2 edge counter value LSB |
|
0x1a |
ASR3 |
ASR3 edge counter value MSB |
|
0x1b |
ASR3L |
ASR3 edge counter value LSB |
|
0x1c |
- |
Unused ?? comparison # 0 MSB |
|
0x1d |
- |
Unused |
|
0x1e |
- |
Unused |
|
0x1f |
OMODE |
Selects operating mode |
|
0x20 |
PORTA |
Port A data |
|
0x21 |
PORTAL |
Port A latch |
|
0x22 |
PORTB |
Port B data |
|
0x23 |
PBCS |
Port B control |
|
0x24 |
TAIT |
timer ASR control |
|
0x25 |
LDOUT |
LDOUT |
|
0x26 |
DOUT |
DOUT data |
|
0x27 |
DOM |
DOUT control |
|
0x28 |
PORTC |
Port C data |
|
0x29 |
PODT |
/ ASRIN Port D data * ASR input data |
|
0x2a |
RAMST |
built-in RAM status |
|
0x2b |
SSD |
serial status * data register |
|
0x2c |
IRQL |
interrupt requests flag(?) MSB |
|
0x2d |
IRQLL |
interrupt request flag(?) LSB |
|
0x2e |
IMASK |
Interrupt mask MSB |
|
0x2f |
IMASKL |
Interrupt mask LSB |
Instructions and Operands
The instructions are similar to 6800 series, but instruction encoding is different. Addressing modes are almost identical to 6800 systems.
Register summary
|
A |
8bit top half of register D |
|
B |
8bit bottom half of register D |
|
D |
16bit data register |
|
X |
16bit index register |
|
Y |
16bit index register |
|
SP |
16bit stack pointer |
|
PC |
16bit program counter |
|
CCR |
8bit condition register |
CCR fields
|
Bit |
Name |
Description |
|
5 |
H |
Half carry from bit.3 |
|
4 |
I |
interruption mask |
|
3 |
N |
negative |
|
2 |
Z |
zero |
|
1 |
V |
overflow |
|
0 |
C |
carry |
Instruction Set Summary
Credits
Kashi -- Written a similar document in Japanese, which served as a main source of information in the original version of this document
