The Subaru SVX World Network   SVX Network Forums
Live Chat!
SVX or Subaru Links
Old Lockers
Photo Post
How-To Documents
Message Archive
SVX Shop Search
IRC users:

Go Back   The Subaru SVX World Network > SVX Main Forums > Technical Q & A

Reply
 
Thread Tools Display Modes
  #1006  
Old 02-01-2010, 01:23 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by NeedForSpeed View Post
Now that's really interesting,
Phil, the Master, does it again, and then again!

Is it possible to change the speed of engagement, the rate of change, the direction of change, i.e. counter at low speed, the max percent of change?
To do that I would need to get the ROM data, but the unit won't allow me to download it using the SSM protocol. I need to pull the unit from the car and see whether there is a ROM chip on the board that I can unsolder, read and replace with a modified one. There's no guarantee that it's chipable.

Since the unit is quite fiddly to get at, I will resist the temptation for the moment. If anybody has a 4WS car already in bits, please post a photo of the internals of the 4WS control unit.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1007  
Old 02-01-2010, 01:36 PM
NeedForSpeed NeedForSpeed is offline
Registered User
 
Join Date: Apr 2004
Location: SoCal / Texas
Posts: 1,738
Registered SVX
Re: Memory dump of ECU

Phil,

That's what I was thinking, find a spare. There is talk of a 4WS car in a breaker in NZ. I'm sure that you would enjoy looking a 4WS computer over
__________________
Special Thanks to Our Friends and Sponsors:
*
http://www.alcyone.org.uk/ssm http://www.PhenixWheels.com http://www.dba.com.au/
http://www.ClassicSoftTrim.com http://ToyoTires.com/tire/pattern/versado-lx Gillman Subaru of Houston
"QuickChange" http://www.TransGo.com/ http://www.PlanetSVX.com Bontrager Works,

'92 Subaru SVX LS-L Claret ORIGINAL OWNER
'92 LS-L Pearl~ '92 LS Pearl~ '92 LS-L Teal~ '92 LS-L Silver~ '95 LSi Polo~
'92 JDM Alcyone SVX Version-L 4WS Pearl~ http://www.subaru-svx.net/forum/showthread.php?t=54143
'92 JDM Alcyone SVX Version-L 4WS Ebony~ http://www.subaru-svx.net/forum/showthread.php?t=54117
Reply With Quote
  #1008  
Old 02-12-2010, 08:40 PM
RoughSilver92 RoughSilver92 is offline
Registered User
 
Join Date: Jun 2008
Location: South Bend, IN
Posts: 208
Registered SVX
Re: Memory dump of ECU

Well, my progress lately has been terribly slow. I've been very slowly working on F653 over the last couple weeks. The rev limiter is easy to understand since the work on that has already been done by others. It looks very simple to make a "launch control" for the manual transmission people. It looks like 86c7 and 86c8 rev limit thresholds are used when in p or n. Probably not the most ideal launch control with the hard fuel cut, but an option nonetheless.
I'm still trying to wrap my head around what's happening in the rest of that block. What keeps messing with my head is
(1071 (speed) -> al)
Quote:
00F6A1 29FF and al, #0xff
00F6A3 F008 beq 0xf6ad
00F6A5 CD2780 cmp al, 0x8027 (hex 08)
00F6A8 B003 bcs 0xf6ad
00F6AA 4C22F8 jmp 0xf822

0F6AD 2C5A108003 bbs #0x80, 0x105a (IDLE SWITCH), 0xf6b5
Ok it doesn't look like much but the bulk of the function (f6b5-f813) is only executed if:
(speed = 0 and the throttle is closed )
or
(speed >= 10mph and the throttle is closed)

Just seems like a weird set of conditions. I guess now it is time to see what the values this function affects do (1340 11dd 10d1)

Oh yeah, this may seem like a stupid question, but does the ecu see reverse speeds as negative? The reason I ask is there is a place where it asks if 1071 (speed) is >= 0, so weather or not the ecu sees reverse as negative would determine it the other path is ever seen in reality.
Reply With Quote
  #1009  
Old 02-13-2010, 12:26 AM
SVXdc's Avatar
SVXdc SVXdc is offline
Radio wiring harness guru
Subaru Gold Contributor
 
Join Date: Oct 2002
Location: Atlanta, GA
Posts: 615
Significant Technical Input Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by RoughSilver92 View Post
Oh yeah, this may seem like a stupid question, but does the ecu see reverse speeds as negative? The reason I ask is there is a place where it asks if 1071 (speed) is >= 0, so weather or not the ecu sees reverse as negative would determine it the other path is ever seen in reality.
It could be checking for an overflow (sign bit set = large positive unsigned number). What is the maximum value that location can store? What speed (mph) would that be?
__________________
David C.
1996 Laguna Blue Pearl SVX L AWD
See my home page for SVX radio install/removal instructions and wiring harnesses
Reply With Quote
  #1010  
Old 02-13-2010, 03:11 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by RoughSilver92 View Post
Well, my progress lately has been terribly slow. I've been very slowly working on F653 over the last couple weeks. The rev limiter is easy to understand since the work on that has already been done by others. It looks very simple to make a "launch control" for the manual transmission people. It looks like 86c7 and 86c8 rev limit thresholds are used when in p or n. Probably not the most ideal launch control with the hard fuel cut, but an option nonetheless.
Yes. The trick to making it work properly for launch control is to reduce the hysteresis from 100rpm to 50 or even 25. It would also allow for "flat foot shifting" because it would limit the rpm whenever the clutch is down.
Quote:
Originally Posted by RoughSilver92 View Post
I'm still trying to wrap my head around what's happening in the rest of that block. What keeps messing with my head is
<code>
Ok it doesn't look like much but the bulk of the function (f6b5-f813) is only executed if:
(speed = 0 and the throttle is closed )
or
(speed >= 10mph and the throttle is closed)

Just seems like a weird set of conditions. I guess now it is time to see what the values this function affects do (1340 11dd 10d1)
I completely agree with your analysis.

Figuring out why it does that is another matter. Speed >= 10 and throttle closed suggests maybe something to do with overrun fuel cut?

Looking through the rest of the function I can see it looks at the torque control switch (gearchange fuel cut?).

Later it looks at some 2D maps based on coolant temp. (Possibly overrun fuel resume rpm based on coolant temperature). Maybe worth extracting them into excel and plotting a graph to see what shape they are.

I suspect that this function is all about various sets of conditions for fuel cut and resume. But I'm just guessing, I haven't studied it at all.
Quote:
Originally Posted by RoughSilver92 View Post
Oh yeah, this may seem like a stupid question, but does the ecu see reverse speeds as negative? The reason I ask is there is a place where it asks if 1071 (speed) is >= 0, so weather or not the ecu sees reverse as negative would determine it the other path is ever seen in reality.
The speed sensor produces 4 electrical pulses per rotation, but it has no way of knowing or signalling the direction of rotation. So speed is always positive.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1011  
Old 02-13-2010, 03:25 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by SVXdc View Post
It could be checking for an overflow (sign bit set = large positive unsigned number). What is the maximum value that location can store? What speed (mph) would that be?
Possibly.

I think it depends whether the branch instruction is BCC/BCS (C flag) or BMI/BPL (N flag). The first would treat the variable as unsigned (0 to 255) the second would treat it as signed (-128 to 127).

The highest positive value in a signed byte variable is 127, which is 254km/h - about 159mph.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1012  
Old 02-13-2010, 03:43 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

I pulled my 4WS unit today and opened it up to have a look. It's a big unit, about double the size of a TCU.

It has a MH73308CP8 microcontroller. That's a custom made and undocumented chip. The CPU core is probably something familiar, but as I can't read the ROM, I can't even try to guess.

There are very strange looking vertical white boards containing component's I've never seen before. Like little squares of silicon.

I don't see any provision for external memory, so probably not possible to reprogram it. Certainly not easy.

Some of the capacitors are leaking brown goo, which doesn't bode well. Reminds me of the ones on Dell PC motherboards.
Attached Images
File Type: jpg Dscn4425.jpg (12.1 KB, 380 views)
File Type: jpg Dscn4426.jpg (1.5 KB, 392 views)
File Type: jpg Dscn4427.jpg (82.7 KB, 389 views)
File Type: jpg Dscn4428.jpg (35.5 KB, 399 views)
File Type: jpg Dscn4429.jpg (24.4 KB, 391 views)
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II

Last edited by b3lha; 02-13-2010 at 03:46 PM.
Reply With Quote
  #1013  
Old 02-13-2010, 05:25 PM
Trevor's Avatar
Trevor Trevor is offline
Registered User
 
Join Date: Feb 2002
Location: Auckland, New Zealand
Posts: 5,223
Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by b3lha View Post
I pulled my 4WS unit today and opened it up to have a look. It's a big unit, about double the size of a TCU.
Connector CN1 provides motor power. CN2 Sensor inputs and control voltages.

Field effect transistors Q16, 17, 18 & 19, provide motor switching. Motor current is sensed via voltage drop across O,3 ohm resistor R79.
__________________
Trevor, New Zealand.

As a child, on cold mornings I gladly stood in cowpats to warm my bare feet, but I detest bull$hit!
Reply With Quote
  #1014  
Old 02-13-2010, 08:18 PM
SVXdc's Avatar
SVXdc SVXdc is offline
Radio wiring harness guru
Subaru Gold Contributor
 
Join Date: Oct 2002
Location: Atlanta, GA
Posts: 615
Significant Technical Input Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by b3lha View Post
Some of the capacitors are leaking brown goo, which doesn't bode well. Reminds me of the ones on Dell PC motherboards.
If you're talking about the cluster of 6 electrolytics near the toroid coil, that looks like glue applied during manufacturing.
__________________
David C.
1996 Laguna Blue Pearl SVX L AWD
See my home page for SVX radio install/removal instructions and wiring harnesses
Reply With Quote
  #1015  
Old 02-13-2010, 10:03 PM
Trevor's Avatar
Trevor Trevor is offline
Registered User
 
Join Date: Feb 2002
Location: Auckland, New Zealand
Posts: 5,223
Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by SVXdc View Post
If you're talking about the cluster of 6 electrolytics near the toroid coil, that looks like glue applied during manufacturing.
Better eyes than mine. ---- Yes it does. It is there to join the ectro's together and prevent vibration causing fatigue breaks in connections.
__________________
Trevor, New Zealand.

As a child, on cold mornings I gladly stood in cowpats to warm my bare feet, but I detest bull$hit!
Reply With Quote
  #1016  
Old 02-14-2010, 04:32 AM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by Trevor View Post
Connector CN1 provides motor power. CN2 Sensor inputs and control voltages.

Field effect transistors Q16, 17, 18 & 19, provide motor switching. Motor current is sensed via voltage drop across O,3 ohm resistor R79.
Thanks Trevor, that's good information. Any idea about the little white boards shown in the final photo?
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1017  
Old 02-14-2010, 04:33 AM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by SVXdc View Post
If you're talking about the cluster of 6 electrolytics near the toroid coil, that looks like glue applied during manufacturing.
OK. I hope that's what it is.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1018  
Old 02-14-2010, 01:26 PM
Trevor's Avatar
Trevor Trevor is offline
Registered User
 
Join Date: Feb 2002
Location: Auckland, New Zealand
Posts: 5,223
Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by b3lha View Post
Thanks Trevor, that's good information. Any idea about the little white boards shown in the final photo?
Sorry Phil, not at the moment.

Often small custom made sub assemblies are attached, as means of economical and convenient assembly of a complete board. If you are in the mood, a side on photo showing the detail could help.

Regards, Trevor.
__________________
Trevor, New Zealand.

As a child, on cold mornings I gladly stood in cowpats to warm my bare feet, but I detest bull$hit!
Reply With Quote
  #1019  
Old 02-14-2010, 05:02 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Re: Memory dump of ECU

Quote:
Originally Posted by Trevor View Post
Sorry Phil, not at the moment.

Often small custom made sub assemblies are attached, as means of economical and convenient assembly of a complete board. If you are in the mood, a side on photo showing the detail could help.

Regards, Trevor.
There's no detail apart from what you can see in the last photo. The silicon wafer is about 4mm square and the window over it suggests that maybe it's sensitive to UV light. Maybe it was a cheap way of making an ASIC if only a small production run was required.

It's nice to know how to talk to the unit and log its data for diagnostics. Even if it could be modified, I'm not sure I would attempt it, as it is rare to the point of irreplaceability. I think as far as the hardware goes: if it ain't broke, don't fix it.

The only computer on my car that I haven't yet managed to talk to is the cruise control unit. I know the command byte is "AB", but I haven't found the trick of making it talk yet.

Does anybody know whether the latest Subaru Select Monitor can talk to the pre-OBD2 cars? The one that has update CDs rather than cartridges. I may be able to borrow a laptop with the SSM3 software, but all the cables with it are OBD2 connector. I suspect our cars may be considered obsolete and unsupported.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #1020  
Old 02-14-2010, 07:41 PM
Trevor's Avatar
Trevor Trevor is offline
Registered User
 
Join Date: Feb 2002
Location: Auckland, New Zealand
Posts: 5,223
Registered SVX
Re: Memory dump of ECU

Quote:
Originally Posted by b3lha View Post
There's no detail apart from what you can see in the last photo. The silicon wafer is about 4mm square and the window over it suggests that maybe it's sensitive to UV light. Maybe it was a cheap way of making an ASIC if only a small production run was required.
.
Phil,

I think you are dead right in presuming that the IC is application specific. I have never run across such an animal. The sub board has some very wide tracks and links, which indicates that substantial control currents are involved.

Overall, that is some box of tricks. A wild thought, --- could the ASIC be involved with inertia!?? In what plane would it lie when mounted in the SVX chassis.

Is there any mechanical, optically, or whatever, device associated with the ASIC?

Cheers, Trevor.
__________________
Trevor, New Zealand.

As a child, on cold mornings I gladly stood in cowpats to warm my bare feet, but I detest bull$hit!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -6. The time now is 06:55 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
© 2001-2015 SVX World Network
(208)-906-1122