Tech    


A summary of the features of the 76xxx Processors



Introduction

Over a number of years of reverse engineering ECUs I have determined that there are many Japanese ECUs that use a processor/microcontroller family numbered 76xxxx, the evidence points to these processors being manufactured by Toshiba. I have never found any documentation for these devices, this document has been prepared from information gleaned from bench testing, code analysis and from the work carried out on the 76C75 (AKA MH6111) by Bill Sundahl and others on the DSM yahoo group.

This is the nearest thing to a datasheet that there is on the internet but the information has been gleaned from reverse engineering and not from the manufacturer's datasheet. Signal and register names are my own using Motorola/Hitachi nomenclature. No claims are made for accuracy, use the data with caution and at your own risk, please do contact me if you have any further information or corrections.

The 76xxx processor appears to be an evolution of the Hitachi HD6301 processor core used in some earlier ECUs. The HD6301 core has been extended with an additional index register (Y) and extra timing functions have been added. The 40-pin DIL variants have a pinout compatible with the 6301 and the Motorola 6801 processor, indeed an Aisin Warner TCM uses only 6801 instructions, ignoring the Y-indexing and additional op-codes completely; the larger packages have unique pin outs. An interesting point to note is that although the lower part of the register set is backwardly compatible with the 40-pin HD6301V the upper registers are not the same, nor are the timers compatible with those of the larger 6301 packages.

For development and testing I am using MGTEK MiniIDE with the Telemark TASM assembler using a modified op-code table, however it is possiblt to use any hc11 compiler if only 6801 instructions are used. I have a Windows based disassembler in development and there are instructions on how to setup MiniIDE here.


Processor Variants

Below is a list of known variants please email me if you know of any others.

Variant Package Marking Image
76C40AP 40-pin DIL Various used by Denso and Aisin Warner
76P40AP 40-pin DIL MH6072 Mitsubishi
76C75T 68-pin PLCC Various used by Mitsubishi and Denso
76P95T 68-pin PLCC MH6172 Mitsubishi
76C175AT 84-pin PLCC MH6211 Mitsubishi
76C55T 84-pin PLCC MH6311 Mitsubishi No image
76C55AF 100-pin TQFP MH6311 Mitsubishi


Package details





Processor pin-outs

This is very much a work in progress not all pin outs are known.

Pin 40-pin 68-pin 84-pin 100-pin
Mode Expanded multiplexed Single Chip Expanded multiplexed Expanded non-multiplexed  
1 GND RW RW RW  
2 XTAL AS AS AS  
3 EXTAL E E E  
4 nNMI GND GND GND  
5 nIRQ XTAL1 XTAL1 XTAL1  
6 nRESET XTAL2 XTAL2 XTAL2 Crystal
7 VCC     nNMI  
8 P20/MD0 5V 5V 5V  
9 P21/MD1     nReset  
10 P22/MD2 nRESET nRESET nHalt  
11 P23 VCC VCC D0  
12 P24     D1  
13 P10     D2  
14 P11 P22/OC1 P22/OC1 D3  
15 P12 P23/RX P23/RX D4  
16 P13 P24/TX P24/TX D5  
17 P14     D6  
18 P15 P10/IC1 P10/IC1 D7  
19 P16 P11/OC2 P11/OC2 5V  
20 P17 P12/OC3 P12/OC3 P20/MD0  
21 VCC stdby P13/OC4 P13/OC4 P21/MD1  
22 A15 P14 P14 P22/MD2/OC1?  
23 A14 P15 P15 P23/RX  
24 A13 P16 P16 P24/TX  
25 A12 P17/PAI P17/PAI P25?/P61?  
26 A11     n.c.  
27 A10 P60 P60 P62  
28 A9 P61 P61 P63  
29 A8 P62 P62 P64  
30 AD7 P63 P63 P65  
31 AD6 P64 P64 AD8  
32 AD5 P65 P65 A9  
33 AD4     A10  
34 AD3 AN7 AN7 A11  
35 AD2 AN6 AN6 A12  
36 AD1 AN5 AN5 A13  
37 AD0 AN4 AN4 A14  
38 R/W AN3? AN3? A15  
39 AS AN2? AN2? A0  
40 E AN1? AN1? A1  
41   AN0? AN0? A2  
42   0VA 0VA A3  
43   5VA 5VA A4  
44   P57 P57 A5  
45   P56 P56 A6  
46   P55 P55 A7  
47   P54 P54 GND  
48   P53 P53 P50?  
49   P52/OC? P52/OC? P51?  
50   P51 P51 P52?  
51   P50 P50 P53  
52   VCC VCC P54  
53   P47 A15 P55  
54   P46 A14 P56  
55   P45 A13 P57  
56   P44 A12 P10  
57   P43 A11 OC2/P11  
58   P42 A10 OC3/P12  
59   P41 A9 OC4/P13  
60   P40 A8 P14  
61   P37 AD7 P15  
62   P36 AD6 P16  
63   P35 AD5 P17?  
64   P34 AD4 GND  
65   P33 AD3 GND  
66   P32 AD2 GND  
67   P31 AD1 ?  
68   P30 AD0 ?  
69       5V  
70       GND  
71       5VA?  
72       5V  
73       GND  
74       AN7  
75       AN6  
76       AN5  
77       AN4  
78       AN3?  
79       AN2?  
80       AN1  
81       AN0  
82       5V  
83       n.c.  
84       Pulled up to 5V  


Register Maps

The 76XXX has a memory map that clearly shows its 6301 origins with control registers and ports located in the first 31 addresses. The first 20 addresses are identical to the 6301 but note that above address 31 the functions appear similar to the 6303, the 6301's 'big brother', but the memory mapping is different and the timer modules have different functionality and appear to have been designed specifically for engine management.
RAM is located from address 40h upwards.


Address Name Function
-------- 6301/6801 Compatible Registers --------
00 PORT1DDR PORT1 Data Direction Register
01 PORT2DDR PORT2 Data Direction Register
02 PORT1 PORT1 Data Register
03 PORT2 PORT2 Data Register
04 P3DDR PORT3 Data Direction Register
05 P4DDR PORT4 Data Direction Register
06 PORT3 PORT3 Data Register
07 PORT4 PORT4 Data Register
08 T1CSR1 Timer1 Control and Status Register 1
09 TMR1H Timer 1 - Free Running Counter High Byte
0A TMR1L Timer 1 - Free Running Counter Low Byte
0B T1OCR1H Output Compare Register 1 High Byte
0C T1OCR1L Timer1 Output Compare Register 1 Low Byte
0D T1ICR1H Timer1 Input Capture Register 1 High Byte
0E T1ICR1L Timer1 Input Capture Register 1 Low Byte
0F P3CSR PORT3 Control and Status Register
10 SCIRMC SCI Rate and Mode Control Register
11 SCSR SCI Control and Status Register
12 RXD SCI Rx Data Register
13 TXD SCI Tx Data Register
14 RAMCR RAM Control Register
-------- 76XXX Specific Registers - all packages --------
15 P5DDR Port5 Data Direction Register
16 PORT5 Port5 Data Register
17 ?? Unused?
18 T1CSR2 Timer1 Control and Status Register 2
19 T2CSR2 Timer2 Control and Status Register 1
1A T2CSR2 Timer2 Control and Status Register 2
1B T1OCR2H Timer1 Output Compare Register 2 High Byte
1C T1OCR2L Timer1 Output Compare Register 2 Low Byte
1D T1ICR2H Timer1 Input Capture Register 2 High Byte
1E T1ICR2L Timer1 Input Capture Register 2 Low Byte
1F P6DDR
ADCCTL
Port6 DDR on 6211
ADC Control on 6111
20 PORT6
ADCRES
P6 on 6211
ADC Result on 6111
21 ?? Unused?
22 ?? Unused?
23 ?? Unused?
24 PACTL Pulse Accumulator Control Register
25 PACNT Pulse Accumulator Counter
26 RTICR RTI Control Register
27 RTIFCR RTI Frequency Control Register
28 ??? Unused?
29 TMR2H Timer 2 Free Running Counter High Byte
2A TMR2L Timer 2 Free Running Counter Low Byte
2B T2OC3H Timer2 Output Compare Register 3 High Byte
2C T2OC3L Timer2 Output Compare Register 3 Low Byte
2D TMR3H? Timer 3 Free Running Counter High Byte ?
2E TMR3L? Timer 3 free Running Counter Low Byte ?
2F PORT6 Port 6 Data Register
-------- 84-pin and 100-pin packages only? --------
30 P7DDR Port7 Data Direction Register
31 PORT7 Port7 Data Register
32 ----------- -----------
33 ----------- -----------
34 ----------- -----------
35 ----------- -----------
36 ----------- -----------
37 ----------- -----------
38 ADCCR ADC Control Register
39 -----------
3A -----------
3B -----------
3C -----------
3D ADCDATA ADC Data Register
3E ----------- -----------
3F ----------- ????????????
-------- Standby RAM --------
? ----------- ????????????
-------- Volatile RAM --------


PORTS

Data Direction Registers - 1=outout, 0=input
Ports shared with other functions, ie timers, are generally read only, unless this is selectable in another register which hasn't yet been discovered (0Fh is unknown).


Timers

Timer 1

Timer 1H, Timer1L - 09h:0Ah

This is a 16-bit Free running counter at 09h and 0Ah and is driven by the E-clock (MH6211=4MHz). Its value can be set by writing a 16-bit word to to 09h.


15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Timer1H Timer1L


Timer 1 Control/Status Register 1 - 08h

7 6 5 4 3 2 1 0
T1ICF1 T1OCF1 T1OIF EICI1 EOCI1 T1OIE IEDG1 OLVL1

bit7 ICF1 - Input Capture Flag 1 Set when an Input Capture 1 Event occurs
bit6 OCF1 - Output Compare Flag 1 Set when an Output Compare 1 event occurs
bit5 OIF Timer 1 overflow Interrupt flag
bit4 EICIn - Enable Input Capture 1 Interrupt Input Capture Interrupt 1 Enable
bit3 EOC1I - Enable Output Compare 1 Interrupt Set to enable an interrupt on output compare event
bit2 OIE - Timer 1 Overflow Interrupt Enable Set to enable
bit1 IEDG1 - Input Edge Select 1 This bit selects which edge causes an Input Capture event
0=negative edge, 1=positive edge
bit0 OLVL1 - Output Level 1 This bit is transferred to P21/OC1 when an Output Compare 1 event occurs


Timer 1 Output Compare 1 - 0Bh:0Ch

A match is generated when OCR1H:OCR1L = TMR1H:TMR1L, an interrupt will be generated if T1CSR1[EOC1I] is set. When a match occurs the logic level at OLVL1 is transferred to ?????? (pin)

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
T1OCR1H T1OCR1L


Timer 1 Input Capture 1 - 0Dh:0Eh

An event occurs when ??????? (pin) changes state if the polarity matches that defined by T1CSR1[IEDG1]. When an event does occur occurs TMR1H:TMR1L is transferred to T1ICR1H:T1ICR2 and T1CSR1[T1IC1IF] is set. An interrupt will occur if T1CSR[T1IC1IE] is set.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
T1ICR1H T1ICR1L

Timer 1 Control/Status Register 2 - 18h

7 6 5 4 3 2 1 0
ICF2 OCF2 OLVL4 EICI2 EOCI2 OLVL3 IEDG2 OLVL2

bit7 ICF2 - Input Capture Flag 2 Set when an Input Capture 2 Event occurs
bit6 OCF2 - Output Compare Flag 2 Set when an Output Compare 2 event occurs
bit5 OLVL4 - Output Level 4 This bit is transferred to P13/OC4 when an Output Compare event occurs
bit4 EICI2 - Enable Input Capture Interrupt n Input Capture Interrupt 2 Enable
bit3 EOCI2 - Enable Output Compare 2 Interrupt Set to enable an interrupt on output compare event
bit2 OLVL3 - Output Level 3 This bit is transferred to P12/OC3 when an Output Compare 2 event occurs
bit1 IEDG2 - Input Edge Select 2 This bit selects which edge causes an Input Capture event
0=negative edge, 1=positive edge
bit0 OLVL2 - Output Level 2 This bit is transferred to P11/OC2 when an Output Compare 2 event occurs




Timer 1 Output Compare 2 - 1Bh:1Ch

A match is generated when OC21H:OCR2L = TMR1H:TMR1L, an interrupt will be generated if T1CSR2[EOC2I] is set. When a match occurs the logic level at OLVL2 is transferred to ?????? (pin)

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
T1OCR2H T1OCR2L


Timer 1 Input Capture 2 - 1Dh:1Eh

An event occurs when ??????? (pin) changes state if the polarity matches that defined by T1CSR2[IEDG2]. When an event does occur occurs TMR1H:TMR1L is transferred to T1ICR2H:T1ICR2L and T1CSR1[T1IC2IF] is set. An interrupt will occur if T1CSR2[IC2IE] is set.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
T1ICR2H T1ICR2L

Timer 2

Timer 2H, Timer2L - 29h,2Ah

This is a 16-bit Free running counter at 29h and 2Ah and is driven by the E-clock (MH6211=4MHz). Its value can be set by writing a 16-bit word to to 29h ????????


Timer 2 Control/Status Register 1 - 19h

This appears to be the CSR for more output compare functions in 1Ah, these functions use Timer 2


7 6 5 4 3 2 1 0
???? ???? ???? ???? ???? ???? ???? ????

bit7 ??? 0 on every loop t3_csr1
bit6 ??? 1 on every loop
bit5 ??? 0 on every loop
bit4 ??? 1 on init but not on every loop, used to decide which of t3_clock1 or t3_clock2 should be used upon a CAS interrupt???
bit3 ??? 1 Set to 0 when the output compare interrupt need to energize coil for cylinder 2 or 3, i.e. bit will be loaded in port5.2 when interrupt occur
bit2 ??? 1 Set to 0 when the output compare interrupt need to energize coil for cylinder 1 or 4, i.e. bit will be loaded in port5.1 when interrupt occur
bit1 ??? 1 on every loop
bit0 ??? 0 all the time except, set to 1 when no cas interrupt received for 1.275sec??? - timer2 overflow????


Timer 2 Control/Status Register 2 - 1Ah

This seems to contain output compare functions


bit7 ??? 0 Input capture 1
bit6 ??? 0 1 indicate that the outCompInt3 interrupt is pending/has been activated???
bit5 ??? 0
bit4 ??? 0
bit3 ??? 1 Cylinder 1/4 or 2/3 ?? output compare detection polarity?
bit2 ??? 0 Cylinder 1/4 or 2/3 ?? output compare detection polarity?
bit1 ??? 1 Cylinder 1/4 or 2/3 ?? output compare detection polarity?
bit0 ??? 0 Cylinder 1/4 or 2/3 ?? output compare detection polarity?


Pulse Accumulator

L0024, PACTL - PA Control Register


bit7 PAOVIF Pulse Accumulator Interupt Flag
bit6 ??? ???
bit5 ??? ???
bit4 PAOVIE Pulse Accumulator Interrupt Enable
bit3 ??? ???
bit2 ??? ???
bit1 ??? ???
bit0 ??? ???

L0025, PACNT - PA Counter

L0026 - RTI_CTRL1

Timer control and status register used for real time interrupt? init to $64 = 1.25ms?

bit7 ??? ???
bit6 TIE ???
bit5 ??? ???
bit4 ??? ???
bit3 ??? ???
bit2 ??? ???
bit1 ??? ???
bit0 ??? ???

L0027 - RTI_CTRL2?

Real time interrupt frequency setting: Freq = 125000/(256-x) where x is the content of rti_freq

L0028 - Unknown

Serial Communications Interface (SCI)

TRCSR1 - Transmit/Receive Control Status Register1


bit7 6 5 4 3 2 1 bit0
7 6 5 4 3 2 1 0

bit7 RDRF - Rx Data Received Set when data is present
bit6 ORFE - Overrun or Framing Error Set when a data overrun or framing error is detected
bit5 TDRE - Transmit Data Register Empty Set when TDR is empty
bit4 PER - Parity Error
bit3 - Not used
bit2 PEN - Parity bit enable
bit1 OEP - Odd/Even parity
bit0 SBL - Stop Bit Length '0'=1 bit, '1'=2 bits


TRCSR2 - Transmit/Receive Control Status Register2


The upper 3 bits are shared with TRCSR1

7 6 5 4 3 2 1 bit0
7 6 5 4 3 2 1 bit0

bit7 RDRF - Rx Data Received Set when data is present
bit6 ORFE - Overrun or Framing Error Set when a data overrun or framing error is detected
bit5 TDRE - Transmit Data Register Empty Set when TDR is empty
bit4 RIE - Receiver Interrupt Enable Set this bit to enable interrupts on data received
bit3 RE - Receiver Enable Set to enable TOF to generate an /IRQ2 interrupt?
bit2 TIE - Transmit Interrupt Enable set this bit to enable interrupt on transmit complete
bit1 TE - Transmitter Enable
bit0 SWU - Wake Up


RDR - Receive data Register



TDR - Transmit Data Register

RMCR - Rate Mode and Control Register



bit7 - Not used
bit6 - Not used
bit5 SS2 Speed Select
bit4 CC2 Clock Control/Format Select
bit3 CC1
bit2 CC0
bit1 SS1
bit0 SS0
CC(2:0) = 001 = Asyncronous mode, 8-bit, internal clock

SS(2:0) = 001 = 16525 baud


Analogue to Digital Converter (ADC)

ADC Control Register

bit7 - ?
bit6 - ?
bit5 - ?
bit4 - Clock Control/Format Select
bit3 GO Start Bit set to 1 to start conversion
bit2-0 C(2:0) ADC channel number

ADC Data Register

8-bit unsigned ADC result


Interrupt Vectors

Interrupt vectors are located at the top of the 64k address range:

FFD8h;    
FFDAh SCI Serial Communications Interface RX ot Tx????
FFDCh    
FFDEh    
FFE0h    
FFE2h    
FFE4h RTI Real Time Interrupt
FFE6h    
FFE8h;    
FFEAh T1OF Timer 1 Overflow
FFECh OC3 Output Compare 3
FFEEh OC2 Output Compare 2
FFF0h OC1 Output Compare 1
FFF2h   ???
FFF4h   Input Capture 2
FFF6h   Input Capture 1
FFF8h nIRQ External Masked Interrupt
FFFAh SWI Software Interrupt
FFFCh nNMI Not Masked External Interrupt
FFFEh nReset System Reset


There is no apparent trap for invalid op-codes, the processor ignores any code that it doesn't recognise.


Instruction Set

The instruction set (this needs verifying) is available as a word document and can be downloaded here:

MH6211 Instruction Set

I have a few test programmes that are available for download, these programmes demonstrate the use of various functions. Note that these programmes were developed for use on Suzuki ECUs with a watchdog timer output on portx bitx. before running any programmes on your hardware you should check the configuration settings for compatibility. These programmes were compiled using the TASM assembler under MiniIDE.

Demo1 Simple I/O Simple I/O
Demo2 Serial Port and timers Serial Port and timers
Demo3 Advanced timer functions and interrupts Advanced timer functions and interrupts
Demo4 Analogue to Digital Conversion Analogue to Digital Conversion

Part Numbers

The 76xxx series appears to follows conventional Toshiba part numbering:
TMP = Toshiba MicroProcessor
76 = Processor series
C = Masked ROM, P = One Time programmable
75 = processor type
A = Enhanced
P = Plastic DIP, T = Plastic LCC, F = Plastic QFP

MH6xxx vs MC68HC11

The MH6xxx processor is a clear evolution of the 6801 as was the 68HC11 but there are significant differences. The instruction sets use different op-codes for many functions, primarily the implementation of the Y index register, that means that HC11 software tools are unsuitable for use with the MH6xxx.
The processor registers are also mapped differently, with the HC11 defaulting to address 1000h and the MH6211 defaulting to or being fixed at address 0000h.
I have not seen any reference to an HC11 style bootloader implemented on the MH6xxx although there is some evidence that there may be one on processors fitted to ECUs using an external EPROM.