Memory dump of ECU - Page 66

RoughSilver92 · #**976** 12-27-2009, 09:39 PM

Oh, that would be cool. I don't know if anybody is working towards that goal, Phil would be the most likely to be in the know on that.
I know there are programs out there that let you make changes with the vehicle running without having to burn new chips every time, but I don't remember reading if any have been used with the SVX ECU.

longassname · #**977** 12-27-2009, 09:51 PM

It sounds like what you are describing is the use of a device/devices called emulators. An emulator/emulators are hooked up to the ECU instead of a ROM and "emulate" the ROM. You load the firmware into the emulator which then functions as the memory for the ECU. For real time tuning an emulator which is capable of being updated without disrupting program execution is used. This means you can edit the data on it without disrupting its ability to be read by the ECU.

typically you see tuning software which allows you to load a binary image of the firmware and then edit tables/data in some user friendly manner....

some/nowadays a lot of tuning software also allows you to load that binary into an emulator so that you can make your edits and see the results while you operate the car

After you are done making your edits you write your new firmware to a ROM

SVXRide · #**978** 12-27-2009, 09:59 PM

Quote:

Originally Posted by longassname

It sounds like what you are describing is the use of a device/devices called emulators. An emulator/emulators are hooked up to the ECU instead of a ROM and "emulate" the ROM. You load the firmware into the emulator which then functions as the memory for the ECU. For real time tuning an emulator which is capable of being updated without disrupting program execution is used. This means you can edit the data on it without disrupting its ability to be read by the ECU.

typically you see tuning software which allows you to load a binary image of the firmware and then edit tables/data in some user friendly manner....

some/nowadays a lot of tuning software also allows you to load that binary into an emulator so that you can make your edits and see the results while you operate the car

After you are done making your edits you write your new firmware to a ROM

Bingo! Give Michael the gold star!

Having experienced first hand what the Hydra does for my 2v7/370cc/cams/etc...etc... SVX, I would love to have a less expensive option that would not require a MAF and would allow for dyno tuning as the engine/car "evolves"
-Bill (still putting $$ away in his Hydra fund....)

longassname · #**979** 12-27-2009, 10:07 PM

Unfortunately there aren't any 16 bit emulators which can be updated without interupting reading that don't cost $$$$$$$$$$$$$$$$

You can use 2 8 bit emulators though.

b3lha · #**980** 12-28-2009, 03:54 AM

Calum built an emulator for the Nissan guys and he was going to build an SVX version too, but I think not enough people were interested to make it worth his while.

Rob Files was working on an emulator for the early WRX ECU and it will work on our ECU too. I haven't heard from him in a while so I don't know whether he's finished it or not.

If you want to run without a MAF then it is possible, but you need an alternative way of figuring out how much air is going into the engine.

The Stock ECU has a fallback method which it uses if the MAF fails. IIRC It uses a map to estimate the airflow based on RPM and Throttle angle. If you unplug the MAF sensor, then start the car, it will run (badly) but it will throw a MAF error code. Obviously the map is calibrated for the stock intake. But I don't think it would be too hard to turn off the error code and update the map to cope with a modified intake. It won't ever run as good as using a MAF sensor though.

The stock ECU fallback method won't work for Forced Induction. For that you need a MAP sensor and you need to modify the program to use RPM and Manifold Pressure instead of RPM and Throttle Angle. That's a difficult project and even then it won't run as good as using MAF.

I'm no expert but I think the best solution is to keep the MAF, but use a bigger one, like LAN does with the stage 3.

longassname · #**981** 12-28-2009, 07:17 AM

If you are afraid the mass air meter is a restriction or it's just easier to plumb or whatever you can use two of them. The voltage is just averaged. You can put two SVX meters in and divide your K constant by 2 since the average voltage is representative of 1/2 of the total mass of air going in the engine.

I suspect you are more interested in running a map sensor because you have been told the mass air meter is too slow and causes a lean tip in. Mass air meters are slow but that is corrected for with the throttle enrichments. If the throttle enrichments need to be adjusted the throttle enrichments need to be adjusted. That's not really a reason to switch to map in and of itself.

I would imagine your best bet for switching to a map sensor is to wire it in place of the mass air meter, fill your primary fuel revision table with something safe like 12.7 and adjust the k constant and then start adjusting the air meter translation table while running on an emulator on a loading dyno in order to get it to actually run a 12.7 afr all the way from idle to max flow. Presumably you wouldn't max out your map sensor so you'd have to interpolate the higher airflows. With that done you'd be back to running right and ready to put real values in your fuel and timing tables. You'd have to redo this anytime you made mechanical modifications to the engine or induction system. That's why mass air systems are generally considered superior to speed density systems (map sensors).

I suspect any performance increases you felt running the hydra were actually from running more timing than for the theorized reasons. You can do the same thing with the stock ecu by taking the timing out of the revision table and adding it to the primary table. Once this is done you are no longer relying on the knock sensors to advance your timing to a performance level which has proved to be a problem for a lot of people. That's what I do in my aggressive software and it worked very well.

NeedForSpeed · #**982** 12-28-2009, 10:40 AM

Quote:

Originally Posted by b3lha

I don't think there is any definite target as such. I think it would be great if we could uncover enough information about how the ECU works that technically skilled owners could have a go at tuning their cars themselves.

It is definitely realistic. We are actually really close to that point right now. We have a well-tested memory adapter design. We know where to find the fuel and timing maps and approximately how they work. All that's really needed is for somebody with tuning skills to fiddle with those maps and log the results and prove that they do work the way we think they do.

So many people have contributed to this thread and I'm amazed at the amount of good stuff has come out of it, directly or indirectly:

* An interface cable for connecting a PC to the car.
* Software that can display and log the ECU and TCU data.
* The locations of the parameters in the ECU and TCU.
* The TCU pin A4 power mode mod for USDM cars.
* The TCU software power mode mod for Euro/Aussie cars.
* A collection of ROM versions from different years and markets.
* A document showing the tuning differences between markets.
* A method for chipping the TCU.
* A daughterboard to adapt the ECU for modern eeproms.
* Decoding the TCU shift and torque converter maps
* Decoding some of the ECU maps
and finally, on a personal note,
* I got a full time job cracking ECUs.

That's just off the top of my head. There's probably a load of other stuff I can remember right now. And it doesn't include stuff outside the SVX world. I regularly get emails from people thanking me for information they've taken from my website and used for their own projects.

I'm particularly pleased that we cracked the TCU. I think we were the first people ever to crack the subaru TCU. In fact I've never heard of any car club cracking a TCU before.

I just wish I had more time to devote to it. I now have a two year old daughter and a 2 month old son, that I didn't have when I started this thread.

Phil, that's an impressive list, so very much to be proud of

Congrats, and continued success

Ron

longassname · #**983** 12-28-2009, 04:41 PM

you figured out and documented the solenoid a duty cycle too...that's pretty cool too

longassname · #**984** 12-29-2009, 06:18 PM

Hey Phil,

Someone asked me an intersting question today for which I don't have the answer and thought I would pass on to you in case you are interested in/willing to look into it.

He asked me how the ecu handles when to start fuel injection. Not the pulsewidth but the timing of fuel injection in relation to crank position/valve opening. I remember the factory service manual mentioning timing fuel injection to end as the valve is opening. It might be fruitful to be able to adjust this.

SVXRide · #**985** 12-29-2009, 06:38 PM

Michael/Phil,

1. I'm already running a z32 MAF with the ECUTune 2v7 chip and 370cc injectors (among other things

)
2. My Hydra experience was, unfortunately, limited to the better part of a single day. What struck me most, from just a driveablity standpoint, was that I suddenly didn't have to worry about the car stalling when I came to a stop sign/light and had to push the clutch in (yeah, it's also got a 5 spd). The car just idled smoothly with no drop in rpms beyond the stock 500-700 rpm setting. Was it quicker? Absolutely, but this could very well be due to the ability to run more timing than the 2v7 chip allows.
3. Yeah, I was thinking if we could replace the MAF with a MAP.

Thanks again for all your hard work!
-Bill

RoughSilver92 · #**986** 12-29-2009, 07:25 PM

I'm not Michael of Phil, but I'll put my 2 cents in.
The 5 speed stall stumps me. While I was in the middle of my 5MT swap I read and reread everything about the 5MT stall, trying to figure out what to do about the problem I was sure to have. But since I have had my 5 speed installed I don't think I have ever experienced the 5 speed stall (or if I ever did I have blocked it from memory). This makes me wonder if either:
A) The people experiencing the 5 speed stall have some part (electrical or electrically controlled probably) not functioning correctly but not throwing a code.
B) The people not experiencing the 5 speed stall (myself included) have some part (could even be an air leak) that is causing them to not experience the problem.

On a different note, I feel fairly confident saying that the function E2F0 is learning the base TPS value (The TPS value at idle/throttle closed). This value is stored at 12C8.

Mrdjc · #**987** 12-30-2009, 03:01 AM

What's this five speed stall your talking about, I've never experienced it on my Legacy and Neither have I heard of the problem being specific to 5th gear on the UKlegacy forum. Usually stalls are throughout the whole range of gears and speed, down to a messed up IACV, TPS or leak.

Must be an SVX thing then? Does it apply to EJ20's as well as the EZ/EG series?

Roughsilver,
good job blowing some life into this project once again!

I've been meaning to do exactly what you are doing now, but lost interest and now I'm studying abroad in Slovakia so my Vehicle is at my parents in storage in Scotland.
Once I get the basics worked out for my N/A I'm hoping to move on into the EJ20 TT setups, as there is a heap of demand out there for it, and the only real option currently is a complete aftermarket ECU but it doesn't really include any of the code that is written into the stock ECU with regards to boost and turbo malarky.

Phil,
Congrats with 2nd child! You must be a really really busy man now!
I think your presence on this thread is probably what is keeping it alive and ticking over, its clear to see it suffers without you.

Wishing everyone a happy new year, and hopefully fruitfull in terms of ECU exploration.

Cheers,
Daniel.

RoughSilver92 · #**988** 12-30-2009, 09:51 AM

[QUOTE=Mrdjc]
What's this five speed stall your talking about, I've never experienced it on my Legacy and Neither have I heard of the problem being specific to 5th gear on the UKlegacy forum. Usually stalls are throughout the whole range of gears and speed, down to a messed up IACV, TPS or leak.
/[QUOTE]

The 5 speed stall is pretty well documented here, but basically it sounds like the people that have it experience stalling when disengaging the clutch after using the engine to slow the vehicle. It's a weird one, though because not everybody has this problem. SVXRide said that the Hydra solved the problem for him. That has me leaning towards the idea that those of us not having the problem have an air leak or something which is why we are not experiencing the problem, but this is purely speculation.

Good luck on you project, Mrdjc.

And Phil is definitely what is keeping this going. Thank you Phil for all your help to me and others.

P.S. I'll be sure to need more help soon

RoughSilver92 · #**989** 01-02-2010, 07:28 PM

What the heck is this?

00B090 3C8F84FF0B bbc #0xff, 0x848f, 0xb0a0

ff is 255, so is it looking 255 bits down, or is it some other crazy business?

SVXdc · #**990** 01-05-2010, 01:10 AM

BBC and BBS opcodes can use "Absolute bit relative" addressing mode (you'll need to look that up in the CPU software manual).

BBC is Branch on (all specified) Bits Clear

The 5th byte of the instruction specifies the relative branch (#0x0B in your example, so [PC] B095 + [offset] 0B = [branch target] B0A0).

Bytes 2 and 3 specify the memory location to read (848F).

Byte 4 specifies which bits to examine to make the decision whether to branch. FF here says to look at all 8 bits in the specified memory location. In other words, branch when all bits in 848F contain 0.

When the m flag is 0 ("16-bit data mode"), then the bit field becomes 16-bits (in bytes 4 and 5), and the 6th byte contains the branch offset.