SVX Network Forums Live Chat! SVX or Subaru Links Old Lockers Photo Post How-To Documents Message Archive SVX Shop Search |
IRC users: |
|
#1
|
||||
|
||||
Memory dump of ECU
I have dumped the memory of my ECU to a file and I'm starting to analyse it. Any other hardcore computer guys want to take a look?
Car: 94 JDM version S40-ii RomID: 742512 CPU is M37791 (Mitsubishi MELPS7700) This file is a dump of the whole 16-bit address space. 0000-00FF is IO 1000-14FF is RAM data (14FF downwards is the program stack) 8000-8FFF is ROM data (possible 16x16 tables at 0x8120 and 0x8e20 ?) 9000-FFCF is ROM code FFD0-FFFF is Interrupt vectors The rest of the address space appears to be unused.
__________________
Subaru ECU and TCU Website 1992 Alcyone SVX Version L 1992 Alcyone SVX Version L 1994 Alcyone SVX S40-II 2004 Subaru Legacy 2.5 SE Sports Tourer 1996 Subaru Legacy 2.2 GX Wagon 1988 Subaru Justy J12 SL-II |
#2
|
||||
|
||||
YEs I am interested how did you dump the data? I tried to open the file and didn't have any luck.
Tony
__________________
1995 - SVX 700,000 K Mine, DMS Struts to lift car 2in. Tyres Wrangler Silent Armor 235/70R16, PBR Radiator. 6 speed with DCCD and R180 rer diff, Heavy duty top strut mounts front and rear. Speedo correction box fitted. New stero (gave up on the old one). Back seat removed and 2 spare tyres fitted for desert driving. ECUTune SC sitting in the box for the next SVX. 1992 - SVX 255 K Wife (Want to stay Married so not allowed to fit SC) 1992 - SVX Pearl with black roof race car roll cauge etc ready to race. Ex Tasman Targa car. 1995 - SVX Green low k mint condiation. 1995 - SVX Rally car, ex Matts car. Now to be used on track. 1992 - SVX red & Black being converted to Mid Engine. 1995 - SVX Red 143,000 bit rough. Owned 5 others Subaru back to a 1974 1400 GSR. |
#3
|
||||
|
||||
Any way you can export it to raw text? Having issues with the .bin.
__________________
*No SVX at the moment...* 1987 Winnebago Elandan 35' 2001 Yamaha Roadstar 1600 2004 Ford Excursion Eddie Bauer, 6.0litre Power Stroke Diesel - Daily Driver. Life should NOT be a journey to the grave with the intention of arriving safely in an attractive and well-preserved body, but rather to skid in sideways, scotch in one hand, body thoroughly used up, totally worn out and screaming HOOOOYA !!!!! |
#4
|
||||
|
||||
OK. Here's some raw text files (inside the zip):
Archive: ECU3.zip Length Date Time Name -------- ---- ---- ---- 331776 04-27-07 14:43 AddressSpace.txt - This is the whole address space from 0000 to FFFF (engine off). 320896 04-27-07 15:32 disassembled-code.txt - This is a disassembly of the program code from 9000 to FEB5. 6240 04-27-07 14:43 RAM-data.txt - This is the RAM data from 1000 to 14FF (engine idling). 19968 04-27-07 14:43 ROM-data.txt - This is the ROM data from 8000 to 8FFF. -------- ------- 678880 4 files I'm putting together some info on how to do this and will post it later today. Phil.
__________________
Subaru ECU and TCU Website 1992 Alcyone SVX Version L 1992 Alcyone SVX Version L 1994 Alcyone SVX S40-II 2004 Subaru Legacy 2.5 SE Sports Tourer 1996 Subaru Legacy 2.2 GX Wagon 1988 Subaru Justy J12 SL-II Last edited by b3lha; 04-27-2007 at 08:35 AM. |
#5
|
||||
|
||||
__________________
Dave - 03 Baja - 92 SVX - 86 Brat - 08 OB 3.0 |
#6
|
||||
|
||||
Quote:
(once the correct parameter addresses are found) Please check my website for further details. I have created a HOWTO for building the interface and posted the results of my investigations so far. http://www.alcyone.org.uk/ssm I have also written some open-source software to download data from the ECU. I am making three of these interfaces with the intention of selling two of them. Currently two are complete, tested and working. The third one is almost complete, just waiting on a part that was out of stock at the supplier.
__________________
Subaru ECU and TCU Website 1992 Alcyone SVX Version L 1992 Alcyone SVX Version L 1994 Alcyone SVX S40-II 2004 Subaru Legacy 2.5 SE Sports Tourer 1996 Subaru Legacy 2.2 GX Wagon 1988 Subaru Justy J12 SL-II Last edited by b3lha; 04-27-2007 at 12:28 PM. |
#7
|
|||
|
|||
Quote:
This seems a quicker and less complicated method to get to the same place as building the interface from scratch. We could then connect with the audio plug described as follows: pin 2 (orange/white) transmit (rs232/ttl) pin 3 (blue/white) receive (rs232/ttl) pin 5 (red/black) to +12V in (choice of above) to +5v out (rs232/ttl) pin 9 (green/black) ground (rs232/ttl) Good show! |
#8
|
||||
|
||||
The only thing wrong with the maps you are showing is the fuel map. It seems at low load, the engine management would want to keep consistant fuel related to higher rpms... To reword that, the map should be flat in low load as rpms increase... Thats what I have seen thus far... make reference to this post ECU Tune's measurements
Tom |
#9
|
|||
|
|||
Hello from Nissan land
Hi,
Just by random luck and insomnia I wandered across this thread. I don't own an SVX or even a Subaru, but do happen to do quite a bit of work with early 90s Nissan ECUs (I make a product called the 'Realtime' daughterboard, it does memory emulation that allows seamless changes to the rom while the car is running, and also bundles the Nissan CONSULT -somewhat like the Subaru diagnostic stuff- over a single USB connection, fun stuff). Anywho, it looks like the ecus have quite a few similarities on the hardware level (they're based on 77xx mcus too), and I thought this might help you guys out. If this is just duplicate stuff you already know, nevermind me. First off, the 7791 looks pretty much identical to the 7790. I'm judging that by the matching interrupt vector tables. I bet they're pretty much the same processor, maybe a different package? If you look in this directory: http://www.calumsult.com/calumsu/disassembler/ Under docs I've posted the short datasheet for the 7790. Also posted is a longer datasheet for a 7700 that is useful for reference. The newer 77xx chips had different peripherals (the ADC changed, etc) than the older ones, and the 7700 is in the same era as the 7790 so its peripheral documentation is useful. It has a different combination of peripherals than the 7790 though (no biggie). Combine its datasheet with the short 7790 datasheet and you've got a pretty decent 7790 datasheet. Also listed is the software manual, but without the stupid 'EOL' splashed in the middle of every page. Anywho, how we've got a different disassemble put together than what your using. Rather than just starting blindly at 8000, ours walks Kaele's dasm77 through the bin, using the interrupt vector table as the starting points. As it disassembles it keeps track of the M and X flag, and sets them correctly. This is a bit more complicated than it sounds, because its doing this for every single branch, and they tend to get quite nested. It takes the disassembler a while to fully run, but the end result is I think a bit more readable. I went ahead and put together a version for the SVX bin that b3lha had posted, check out the SVX directory. The disassembler will also autocomment known memory variables, and you can add to the list in a file called memory.txt. I put the locations b3lha had listed in when I ran the disassembler. The big txt file in the SVX folder is the result. I went ahead and posted the SVX version of the disassembler exe and source code (its in C++, and compiles under the free MS Visual C++ 2005 Express compiler). Its a console app, and you need to have it in the same directory as DASM77. Also, I didn't compile it for use on machines that don't have C++ Express installed (I'll do that later), sorry! If you want to add to your current disassembler the code above has the memory locations for the peripherals, and correct order and contents of the interrupt vector table. Btw, on your interface problem, I'd guess that the ecu RX signal isn't exactly CMOS compatible (i.e. truly 0-5V logic). The Nissan CONSULT had a similar issue. A quick look with a 'scope would verify this (want to ship me an ecu and wiring harness, lol?). Just stick a comparator in front of the max232. I'd be happy to whip out a schematic if you need help. Also, if your wanting to use that for real datalogging I'd look into speeding up the transmission speed, the Subaru speed is just slow. Nissan has CONSULT set to 9600 baud and thats just barely fast enough for datalogging. Changing the UART speed on the 77xx is a bit of a pain in the butt, its a bit more than just changing the code, stupid old processor. Last edited by Calum; 08-21-2007 at 01:59 PM. |
#10
|
||||
|
||||
Quote:
Quote:
I am undecided whether to use your disassembler or update mine with your ideas. At present I'm using a linux box which rules out MS C++. Quote:
I've had a look at some comparator datasheets (LM339 & LM311) but I can't figure out how to add them to our circuit. If you have a schematic it would help immensely.
__________________
Subaru ECU and TCU Website 1992 Alcyone SVX Version L 1992 Alcyone SVX Version L 1994 Alcyone SVX S40-II 2004 Subaru Legacy 2.5 SE Sports Tourer 1996 Subaru Legacy 2.2 GX Wagon 1988 Subaru Justy J12 SL-II |
#11
|
||||
|
||||
Quote:
The shape of the graph comes from the data in the table. It's the scales and units that I'm not 100% sure of. Thanks for posting the ECUtune graphs, I'd been looking for them, but couldn't find them. I'm happy that they look fairly similar to mine. I understand what you are saying about the map should be flat in low load as rpms increase. I'll check the code again and make sure I haven't got the scale backwards. There are some other tables in the memory that probably have an effect on things. I don't understand what they do yet.
__________________
Subaru ECU and TCU Website 1992 Alcyone SVX Version L 1992 Alcyone SVX Version L 1994 Alcyone SVX S40-II 2004 Subaru Legacy 2.5 SE Sports Tourer 1996 Subaru Legacy 2.2 GX Wagon 1988 Subaru Justy J12 SL-II |
#12
|
|||
|
|||
So I am back with some news.
I sent the hexcode and my ecu answer with this. TX>78123400<TX 0042000000 I am sure that the code came from the ecu because when i unplugged the Select-Monitor-Connector then i got nothing back. Is my ECU a special one? I can change this settings for the Converter. http://img141.imageshack.us/img141/7...ngscom3uk3.jpg Are the parameters correct? This parameters are the defaults. I test some values but without a success. Last edited by Tobi; 10-22-2007 at 11:21 AM. |
#13
|
|||
|
|||
YES it works
This is the correct wiring: GND(black)(USB-cable) to GND (green/black)(SSM-connector) TXD(orange)(USB-cable) to RXD (blue/white)(SSM-connector) RXD(yellow)(USB-cable) to TXD (orange/white)(SSM-connector) Green Light for this Adapter http://apple.clickandbuild.com/cnb/s...dCategoryID=47 Thx 4 help @all |
#14
|
||||
|
||||
Hahaha, the transmit/receive wiring was just backwards? I love simple fixes.
I'll have to check out that adapter, it looks really promising. |
#15
|
|||
|
|||
Yes that was the problem
The Adapter is absolutely advisable. If you know the wiring you can build it in few minutes. In the next days i will check the adapter thoroughly. Tobi |
|
|