Over a number of years of reverse engineering ECUs I have determined that there are many Japanese ECUs that use a processor/microcontroller family numbered 76xxxx, the evidence points to these processors being manufactured by Toshiba. I have never found any documentation for these devices and this document has been prepared from information gleaned from bench testing, code analysis and from the work carried out on the 76C75 (AKA MH6111) by Bill Sundahl and others on the, now lost forever, DSM Yahoo group.

This is the nearest thing to a datasheet that there is on the internet but the information has been gleaned from reverse engineering and not from the manufacturer's datasheet. Signal and register names are my own using Motorola/Hitachi nomenclature. No claims are made for accuracy, use the data with caution and at your own risk, please do contact me if you have any further information or corrections.

The 76xxx processor is an evolution of the Hitachi HD6301 processor core used in some earlier ECUs. The HD6301 core has been extended with an additional index register (Y), extra timing functions have been added and the instruction set greatly extended. The 40-pin DIL variants have a pinout compatible with the 6301 and the Motorola 6801 processor, indeed an Aisin Warner TCM uses only 6801 instructions, ignoring the Y-indexing and additional op-codes completely; the larger packages have unique pin outs. An interesting point to note is that although the lower part of the register set is backwardly compatible with the 40-pin HD6301V the upper registers are not the same, nor are the timers compatible with those of the larger 6301 packages.

For development and testing I am using MGTEK MiniIDE with the Telemark TASM assembler using a modified op-code table, however it is possiblt to use any hc11 compiler if only 6801 instructions are used. I have a Windows based disassembler in development and there are instructions on how to setup MiniIDE here.

Below is a list of known variants please email me if you know of any others.

This is very much a work in progress not all pin outs are known.

The 76XXX has a memory map that clearly shows its 6301 origins with control registers and ports located in the first 31 addresses. The first 20 addresses are identical to the 6301 but note that above address 31 the functions appear similar to the 6303, the 6301's 'big brother', but the memory mapping is different and the timer modules have different functionality and appear to have been designed specifically for engine management.
RAM is located from address 40h upwards.

The register map for the 76C55 (100-pin) is quite different from the smaller devices, currently it is a work in progress and can be found here : 76C55 Register Map

Data Direction Registers - 1=output, 0=input
Ports shared with other functions, ie timers, are generally read only, unless this is selectable in another register which hasn't yet been discovered (0Fh is unknown).

This is a 16-bit Free running counter at 09h and 0Ah and is driven by the E-clock (MH6211=4MHz). Its value can be set by writing a 16-bit word to to 09h.

A match is generated when OCR1H:OCR1L = TMR1H:TMR1L, an interrupt will be generated if T1CSR1[EOC1I] is set. When a match occurs the logic level at OLVL1 is transferred to ?????? (pin)

An event occurs when ??????? (pin) changes state if the polarity matches that defined by T1CSR1[IEDG1]. When an event does occur occurs TMR1H:TMR1L is transferred to T1ICR1H:T1ICR2 and T1CSR1[T1IC1IF] is set. An interrupt will occur if T1CSR[T1IC1IE] is set.

A match is generated when OC21H:OCR2L = TMR1H:TMR1L, an interrupt will be generated if T1CSR2[EOC2I] is set. When a match occurs the logic level at OLVL2 is transferred to ?????? (pin)

An event occurs when ??????? (pin) changes state if the polarity matches that defined by T1CSR2[IEDG2]. When an event does occur occurs TMR1H:TMR1L is transferred to T1ICR2H:T1ICR2L and T1CSR1[T1IC2IF] is set. An interrupt will occur if T1CSR2[IC2IE] is set.

This is a 16-bit Free running counter at 29h and 2Ah and is driven by the E-clock (MH6211=4MHz). Its value can be set by writing a 16-bit word to to 29h ????????

This appears to be the CSR for more output compare functions in 1Ah, these functions use Timer 2

This seems to contain output compare functions

Timer control and status register used for real time interrupt? init to $64 = 1.25ms?

Real time interrupt frequency setting: Freq = 125000/(256-x) where x is the content of rti_freq

8-bit unsigned ADC result

Interrupt vectors are located at the top of the 64k address range:

There is no apparent trap for invalid op-codes, the processor ignores any code that it doesn't recognise.

The instruction set (this needs verifying) is available as a word document and can be downloaded here:

MH6211 Instruction Set

I have a few test programmes that are available for download, these programmes demonstrate the use of various functions. Note that these programmes were developed for use on Suzuki ECUs with a watchdog timer output on portx bitx. before running any programmes on your hardware you should check the configuration settings for compatibility. These programmes were compiled using the TASM assembler under MiniIDE.

The 76xxx series appears to follows conventional Toshiba part numbering:
TMP = Toshiba MicroProcessor
76 = Processor series
C = Masked ROM, P = One Time programmable, E = EEPROM
75 = processor type
A = Enhanced
P = Plastic DIP, T = Plastic LCC, F = Plastic QFP

76xxx vs MC68HC11