Memory dump of ECU
 

I have dumped the memory of my ECU to a file and I'm starting to analyse it. Any other hardcore computer guys want to take a look?

Car: 94 JDM version S40-ii
RomID: 742512

CPU is M37791 (Mitsubishi MELPS7700)

This file is a dump of the whole 16-bit address space.

0000-00FF is IO
1000-14FF is RAM data (14FF downwards is the program stack)
8000-8FFF is ROM data (possible 16x16 tables at 0x8120 and 0x8e20 ?)
9000-FFCF is ROM code
FFD0-FFFF is Interrupt vectors
The rest of the address space appears to be unused.

:cool:

YEs I am interested how did you dump the data? I tried to open the file and didn't have any luck.
Tony

Any way you can export it to raw text? Having issues with the .bin.

OK. Here's some raw text files (inside the zip):

Archive: ECU3.zip
Length Date Time Name
-------- ---- ---- ----
331776 04-27-07 14:43 AddressSpace.txt - This is the whole address space from 0000 to FFFF (engine off).
320896 04-27-07 15:32 disassembled-code.txt - This is a disassembly of the program code from 9000 to FEB5.
6240 04-27-07 14:43 RAM-data.txt - This is the RAM data from 1000 to 14FF (engine idling).
19968 04-27-07 14:43 ROM-data.txt - This is the ROM data from 8000 to 8FFF.
-------- -------
678880 4 files


I'm putting together some info on how to do this and will post it later today.

Phil.

OK, now the real question???

Does subavanagon + Your Memory Dump Info + This and a few things =

http://www.vwrx.com/selectmonitor/gauges.jpg

YES:D
(once the correct parameter addresses are found)

Please check my website for further details. I have created a HOWTO for building the interface and posted the results of my investigations so far.
http://www.alcyone.org.uk/ssm
I have also written some open-source software to download data from the ECU.:cool:

I am making three of these interfaces with the intention of selling two of them. Currently two are complete, tested and working. The third one is almost complete, just waiting on a part that was out of stock at the supplier.

For folks in the states: the audio harness used to connect to the Subaru diagnostics plug is a Metra 70-1780 or Scosche SU-02 (one of the two pieces in the kit — the one with the 8 speaker wires).

If you want to get fancy, you can transplant the Red (+12V) and Black (Ground) wires from the other harness so those pins are the correct colors, plus any other colors you'd like to use for Transmit and Receive.

Attached are pictures of the pair from Crutchfield.com, and a head-on view drawing.

JSRBBQSAUCE. I haven't played with assembly in a bazillion years!

That is cool, Phil. I'd like to look through that code disassembly at some point. I'd want to poke around the net and see if there's any kind of tool that can help plug symbols back in, to make it a little more readable.

:confused: :confused: :confused:

Well fortunately, this CPU is a bazillion years old!

It was far from cutting-edge even when the car was built 15 years ago. It's a newer variant of the old 6502 chip from the BBC Micro of 1982 and a lot of the instructions are very similar. I spent most of my early teens learning how to program my BBC Micro and somewhere:confused: I've got a well-used book on 6502 assembler. I knew it would come in handy one day!:D

Phil, you ARE the cutting edge. :D

We certainly have a range of in depth skills on the network. :)

Good one, Trevor.

By 'a few things' you mean a dropping resistor, voltage divider or other voltage converter to reduce the vehicle's 12V+ to 5V+ for the RS232/TTL converter linked to above or similar premade device?

This seems a quicker and less complicated method to get to the same place as building the interface from scratch.

We could then connect with the audio plug described as follows:

pin 2 (orange/white) transmit (rs232/ttl)
pin 3 (blue/white) receive (rs232/ttl)
pin 5 (red/black) to +12V in (choice of above) to +5v out (rs232/ttl)
pin 9 (green/black) ground (rs232/ttl)

Good show!

The MAX232 chip is somewhat susceptible to blowing up when the voltage goes out of range, so a voltage converter is recommended.

The 78L05 is an ideal part — The TO-92 version (package that looks like a transistor) is tiny, very inexpensive (less than $1), and provides more than enough current (100mA), where the MAX232 draws at most 10mA. The larger 7805 is rated up to 1A. The wiring is exactly the same.

Viewing the pins-side of the connector, oriented as in the drawing in my earlier post, the pin numbers run from 1 at the top left corner, across the top to 4, then resume on the bottom left with 5 across to 9.

The car's factory wire colors are different in my '96, as well as on the '96 wiring diagram:
2 — Brown/White
3 — Green/Red
4 — Red/Blue
5 — Brown/Red
9 — Black/Red

Pin 4 goes to the Cruise Control module. All other positions are unpopulated.

I thought some of those instructions and opcodes looked really familiar. I played with the Apple ][ way back when.

It'll only come in handy if you can find it :D. Fortunately, there's always the Internet.

I'm talking about the colours on the radio harness connector, not the car. :rolleyes:
:)

I knew that. I was replying to cdvs' post, which appeared to be referring to the car's wiring.

I was referring to the connector described by b3lha (Phil) in the interface build instructions. I hadn't noticed your (SVXdc) connector pictures, which do have different colored wires. Now that I have, I can't see which goes where well enough to translate. Perhaps you could do it?

:confused:

y'all lost me at " Memory Dump of ECU "
:eek:

Ah, I read through Phil's doc again and see now. You both were indeed talking about the colors on the audio harness Phil found. Very odd color scheme — not the EIA standard found on most car radio harnesses today.

Here's another drawing with the pin numbers (lower connector with 9 pins):
http://www.subaru-svx.net/forum/atta...6&d=1177806816 <- This one.

View is looking at the contact pins on the CAR'S harness (wires pointing away from you). On the aftermarket harness, this would be the side with the wires pointing towards you, pins pointing away.

For the pins in question, the EIA standard wire colors are:

2 — White => Transmit
3 — Green => Receive
5 — Gray/Black => +12V
9 — Violet/Black => Ground

As I suggested earlier, since you're going to extract the unneeded wires anyway, you might as well transplant the Red and Black wires from the 7-pin connector into pins 5 and 9, respectively.


The attachment to this post is the same gif as above, in case the link goes bad. Drawing courtesy of NASIOC's vrg3, on this page that shows the entire pin-out of the radio connectors.

This is looking at the contact pins of the female end (car). If you look into the male end (audio harness) the numbers are obviously reversed:

43_21
98765

Just so you know, I did swap in the red and black wires on the first one I made. I didn't do it for the second one because I didn't want to the complicate the HOWTO.

These things are really easy to make. It takes me about two hours now I know how to do it.

Further options for those who don't want to build their own circuit:

http://www.active-robots.com/product.../act-sib.shtml

Look at the second and third items on the page.

I'm not sure about the USB device. The PC will see it as a serial port, but it's not a standard 16550A. You might have to modify the software to set the baud rate correctly.

Strait.
 

Now this is a good thread!

Thanks for pointing that out. I've edited my previous post to be a little more clear.

Great write up. Just wondering what program you use to run the linux version software?

It's C source code, tarred and gzipped. You extract it with "tar -xzvf filename.tar.gz" and then run "make" to compile it.

ssm.c contains functions to access the ecu. It compiles to ssm.o
ecudump.c compiles to an executable called ecudump. When you run ecudump, it calls the functions in ssm.o to extract data from the ECU and write it to a file.

If/when I've worked out enough of the memory locations in the ECU I'll write something to display them graphically in real time. If you know how to program, then you can write your own software to call the ssm functions and display the data however you want it.

I got some emails that people have been trying to PM me but my mailbox was full. I've cleared some space now. You can also email me at b3lha:rolleyes: alcyone:)org:)uk.

bump
 

just want to keep track of this posting as I understand assembly so this might be something I can play with later. :)

So far I've had good results doing this on my 94 SVX Version S40ii and my 96 Legacy. I've just discovered that it doesn't work on my 91 SVX Version L. :(

It connects OK and the ECU does respond to the commands I send. But the data it sends back does not conform to the protocol. The response is different every time I run the command :confused: . It looks random. I thought maybe my ECU had a faulty transmitter, so I tried it on another 91 Version L - and that one does exactly the same thing!

Maybe the early cars use a different protocol. Maybe it's just the 4WS cars. Maybe they are actually both faulty in the same way. Could be a bug in the early CPUs. At some point I'll investigate further.

For now I'm going to concentrate on figuring out the assembly code. I've already found a few interesting routines, but it's slow and time-consuming work. I'll post some updates on my website when I have enough information to make it worthwhile.

Phil.

I had a bit of a breakthough with the parameter locations. I found that one of the parameter sets supplied with the software was a partial match for my Legacy. So I disassembled the Legacy firmware, looked at the code that accessed those locations, and then looked for similar code in the SVX firmware. Further information on my website http://www.alcyone.org.uk/ssm

I took a couple of screenshots of the software running on my 94 SVX. Could one of the engine gurus please comment on whether the data looks correct?

http://www.subaru-svx.net/photos/files/b3lha/43938.jpg
http://www.subaru-svx.net/photos/files/b3lha/43939.jpg

Phil.

Great progress!

Any chance we could get some pictures large enough to read?

Thanks for your efforts.

Pictures Enlarged.:)

My guess is that LAN is the "guru" to be chatting with on this...
-Bill

I'll take whatever help I can get. All I'm asking at present is whether the values shown in the screen shot are reasonable for an EG33 running at 2000rpm.

I reckon the RPM, TEMP, MAF, LOAD and TPS are right and the knock correction might be wrong. The others I don't really don't know if the values are within the ballpark or not.

Phil, you are doing some great work.

I therefore hope that my opinion, in answer to your query, may make you happy, i.e. that your ignition advance figure appears OK, at something around 42 degrees.

At light loads, as in normal everyday cruise conditions, an ignition advance of 36 - 40 degrees is now common. Engines with very good combustion chamber design will be able to run up to 45 degrees in these conditions. Fuel economy is obviously very much dependant on light load ignition timing.

At high loads and engine speed there can be large variations, engine to engine. I have seen specs from 10 to 30 degrees. Obviously there are many variables involved including fuel octane rating.

You will appreciate all of the above comments are confined to normally aspirated engines.

Cheers, Trevor.

Thanks Trevor, your wisdom is appreciated as always.

I just had another peek at the code on my lunch break and I've found the parameters for battery voltage and vehicle speed - so the top two rows of gauges are fully populated now.

This is awesome! Ever since Vikash put out the code for the first-gen Legacy I've wanted to try this, and now there's gonna be an SVX version.:D Sadly I don't know any assembly so I can't be of much use except as a beta tester. I've got an old omnibook sitting around with the proper port, I just have to make the Serial->SM plug for it.

I read through the info on your site... I'd say SVXride is right. At least for the fuel maps, you should try to get in touch with Longassname. He's written his own for the SVX, so I think he's the resident genius in that field. :)

SVXRide & Nomake Wan,

I am aware that Longassname has done all this work before and is the established expert in the matter. But I deliberately haven't asked him because he is in the ECU tuning business and I don't think it's fair to ask him to give away his commercial secrets. If he wishes to volunteer some information then that is his call.

I am not in the engine tuning business and I will make public whatever information I can find about the ECU for the benefit of the SVX community. I am hoping by making this knowledge available, that other people will build upon it and we'll see some interesting new developments.

Phil.

MED text editor is a great assembly language editor (supports higher level languges too). I find it simple to use and I appreciate the color coding when sifting through code.
MED Programmer's Editor
If you want to try another program. There is ASM IDE which is another simple yet useful tool. I use it with my Dragon12 board for assembly programming.
Embedded Tools by Eric Engler
Now that school's out, I think I will try to sit down with that code and see whats going. I am not knowledgable about engines so I will ask some local SVXers for help in that area(odepaj, sa svx - I'm thinking of you guys!). :)
cheers!
Marisa

Hi Marisa,

Thanks for your interest. The job is sure to be easier with two of us working on it.

Be sure to pick up the latest copy of the disassembled code from my website. I uploaded an updated copy a few minutes ago. I've fixed up areas where the disassembler got confused by inline data or incorrect M flag. I've broken it down into subroutines and added some comments.

I'll be adding further comments as my analysis continues.

Phil.

I think I downloaded the latest code from your site and hoping I can work through it on my free time. My mom has me going over to do a few projects for her. One being - installing a new laminate floor in her living room this week. So we'll see how much free time I can get my hands on! :)
Take care,
Marisa

Greetings Marisa,

It is the little asides within the technical stuff, that make this site so interesting. You must be jack of all trades, which is an attribute close to my heart. :D

P.S. All the best to you both, in your combined effort. *<)