ECU Tuning

[Myxalplyx]

Can someone explain to me why todays tuners that tune the late model Subaru ECU can not tune an old school Subaru's ECU?

[jeffast]

because today the ecu handle fuel management, fuel injector timing, igntion timing, and a bunch of other stuff handled manually in the old day, not to mention that todays ecu's are actual computers that can be reprogrammed, the ecu's from the eighties were hardwired to do one thing with no programming modification allowed

[NorthWet]

because today the ecu handle fuel management, fuel injector timing, igntion timing, and a bunch of other stuff handled manually in the old day, not to mention that todays ecu's are actual computers that can be reprogrammed, the ecu's from the eighties were hardwired to do one thing with no programming modification allowed

The real reason is money. There isn't any in it with the earlier cars.

 

I haven't opened up an EA81's ECU, but the EA82's ECU contains a real microprocessor; a 6502, IIRC, or a 6809 if IIDRC .

[PoorManzImpreza]

..and the 87+ ea82 ecus have a socket for an extra ROM chip and a serial interface of some kind..

[jeffast]

huh really learn somthing new evreyday

[ausubaru92]

the EA82's ECU contains a real microprocessor; a 6502, IIRC, or a 6809 if IIDRC .

 

So does that mean they can be re-mapped, but we just have to find a way to do it:brow:

 

Gannon

[NorthWet]

So does that mean they can be re-mapped, but we just have to find a way to do it:brow:

 

Gannon

Certainly... if someone wanted to spend the time to reverse-engineer the coding and the maps. The question really is: Wouldn't it be better to use an up-to-date, forward-engineered ECU? MegaSquirt comes to mind.

 

Or, a direct replacement that fits the original ECU case and connectors. Wouldn't THAT be something?

[D-Cal]

I work on Dodge turbo cars 84-94. We have a similar problem in that there is almost zero aftermarket. As a group we've managed to reverse engineer the ROMs to the point where we can convert them from a 2 bar MAP to a 3 bar, rescale for larger injectors, change the fan schedule etc. I make a program called "D-Cal" (surprise) that is free to download and allows you to edit your ROM files. It supports flashing a modified computer, and I am (slowly) working on support for a ROM emulator (www.xtronics.com) that will allow you to alter fuel and spark in realtime, on the dyno.

 

Pull the ROM from the computer, scan out the contents and disassemble the code. Look up the white papers on the processor and make note of the addresses of the hardware bits. A chunk of code addressing the area that deals with the crank sensor can be marked off as having something to do with engine timing, etc. This gives you a clue as to what a particular chunk of code is doing. Slowly, over time you can build up enough knowledge about the code to allow you to intelligently alter the contents to achieve your goals.

 

There are many good reasons to keep and modify the stock computer. Emissions appearance in some states like CA for instance, maintaining the "stock" look, not wanting to do a lot of cutting and splicing of the wiring harness, many more. Many times, like the Dodge ECMs, they are actually very capable systems and once the code is cracked they can do anything an aftermarket ECU can do. There are a couple of Ford mustang guys running Dodge computers with my editing software for that reason.

 

The 6502 processor is what was used in the Commodore 64. While this is kinda humorous, it also means there are a lot of tools out there for assembling and disassembling your flavour of code. Many hobbyists still program and work with the C64.

 

Newer ODB-II cars are trickier to work with, but there are published protocols that would allow you to do things like datalog sensors etc. without completely disassembling the code.

 

So it's quite possible to develop your own ECM editing tools, it just takes a couple of computer-knowledgeable people to spend some time disassembling and sharing the results. If such a group exists, I'd be interested in talking to them.

[Myxalplyx]

So it's quite possible to develop your own ECM editing tools, it just takes a couple of computer-knowledgeable people to spend some time disassembling and sharing the results. If such a group exists, I'd be interested in talking to them.

 

D-Cal,

 

My question is, are you capable at cracking the EA82 (specifically the turbo model) code? If so, PM me and perhaps we can talk offline. Thanks!

[D-Cal]

Am I capable? Yes. Do I have time? Unfortunately no. But if a computer savvy individual wants to take a whack at it, I can give some basic pointers on how best to proceed.

[NorthWet]

Disassembling a program can be a real pain, especially if you have no information as to how the hardware is defined. It can be done, just takes patience and time. The one thing that we have in our favor is that the hardware is relatively simple, so the ECU's functions are relatively simple.

[D-Cal]

Disassembling a program can be a real pain, especially if you have no information as to how the hardware is defined. It can be done, just takes patience and time. The one thing that we have in our favor is that the hardware is relatively simple, so the ECU's functions are relatively simple.

 

If you get a disassembler that uses a symbol file during source generation, you can feed in everything you know about the memory map. From there you start labelling routines based on what you think they are doing with the memory locations you know about. Repeated cycles between observing the code and updating the symbol file for generation will eventually get you to fully commented source.

[NorthWet]

If you get a disassembler that uses a symbol file during source generation, you can feed in everything you know about the memory map. From there you start labelling routines based on what you think they are doing with the memory locations you know about. Repeated cycles between observing the code and updating the symbol file for generation will eventually get you to fully commented source.

Like I said, it can be a real pain.

 

At this point, nobody knows anything about the memory map, so initial learning curve will be quite steep. I can't remember offhand whether or not the 6500/6800 series had I/O ports/instructions, or whether the ECU developer would use them or just do memory-mapped I/O. As I typed, the only thing really working in our favor is the relative simplicity and smallness of the code.

[D-Cal]

Like I said, it can be a real pain.

 

Have you ever reverse engineered anything?

 

What we found was that once you had mostly decoded one model year's code, you could take advantage of the similarities in other years to get a head start on other codebases.

 

It's not really hard work, just time consuming. But it can be fun too, like detective work, or a very complex puzzle.

 

That particular CPU can only address 64K max, and probably only has 16K or 32K of ROM in the address space. It's not really that hard to decipher code that small once you get a few addresses mapped. It will snowball.

 

I believe the 6502 was memory mapped, but it's been about 20 years since I've done any assembly for that processor.

[NorthWet]

Have you ever reverse engineered anything?...

Yes.

...I believe the 6502 was memory mapped, but it's been about 20 years since I've done any assembly for that processor.

It's been about 25 years since I did assembly language on the Z80, and about the same length since I looked at the other contemporary 8-bit processors. (I should still have all of the OSBORNE Press books, though.)

 

In the interim (up until 3 years ago), I have been doing assembly language on IBM mainframes. Mostly, reverse engineering OSs and compilers to develop debuggers, and to bypass OS routines to do native I/O and interrupt handling. Also catching compiler runtime error/warning codes, and replace compiler runtime routines with our own. All sorts of fun stuff. One of the relevant aspects of this was memory dump analysis, which was, essentially, on-the-fly reverse engineering.

 

Anyway (*sheepishly gets down off of his soapbox*), I do have a little background. Yes, it is certainly doable. Will anyone do it? Probably not, as it is some amount of work, and the work will not be monetarily rewarded. The concept of pro bono publica only goes so far.

[WJM]

Why wont anyone decode and offer a flash for any subaru other than the WRX, STi, 2.5 RS? No profitable market. Although the SVX's have flashes avalible...that is a VERY niche market corner....those SVX guys are pretty far out there (those who are into modifications for them atleast)

 

Us EA82 guys are all about the $....how much can we NOT spend and make it the best and fastest car out there. That is the main issue.

 

On top of that there is really no one out there with enough patience to deal with us. Why do you think there are no real vendors here?

 

On the otherhand, since the cars are not an OBD-II car, it would save alot of time, money, and head pains to get a MegaSquirt.

 

If you want something more....real...as others have described it...find a used AEM or Hydra on ebay and wire it on up. Its not difficult.

[D-Cal]

Anyway (*sheepishly gets down off of his soapbox*), I do have a little background. Yes, it is certainly doable. Will anyone do it? Probably not, as it is some amount of work, and the work will not be monetarily rewarded. The concept of pro bono publica only goes so far.

 

Well, we've done it for the turbo Dodge cars. The editing program I publish is free for download. I have several hundred hours of development time in it now and I give it away. There are 600+ members in my Yahoo group learning how to use it. Many other guys contribute by deciphering calibrations, posting 3 bar custom versions, modifications that light CHECK ENGINE when the ECM sees knock, and so on.

 

Early on we formed a talented group of individuals, opened an exclusive Yahoo group for the purpose of cracking the code. It can be done, you just need people interested in and capable of tuning their own cars, with a side of electronics background.

 

It was never about the money, it was about being in control. What value would you place on being able to change your injectors to any size you want? Being able to set your boost goal anywhere you want? Not having to jimmy-rig your fuel system with RRR + AFPR to fool the computer into working with stuff it was never engineered to?

 

If that stuff has no value for you or you guys are too lazy to go after it, I'll just shut my mouth right now. I'm really surprised that guys who drive K-cars have more initiative than this bunch.

[Vanislru]

I got $ and would love a reflash option, in fact I have 3 spare ecu's that I could donate. D-cal if you do want to do something like this then you can count on me for at leaast beer and pizza lol.

 

Peeps have alot about the no money ea82 prob's but I for one have no issue's about dropping $$$$ here and there if I think it's worth it. Hell my 4.44 gears alone were almost $780usd.

Hows Edmonton? I used to work for Shell at their Scottsford refinery can't really say I miss that place tho.

[NorthWet]

D-cal, the methodology you desribed for the Turbo Dodge group sounds great, and it would be nice if we could get something like that started. I personally think that it would be worthwhile, and I will take a look at the program that you so generously have shared with us. Thank you.

[Myxalplyx]

Looks like this may be heading somewhere. I'm one of those guys who would not dropping some $$$ for something like this. My turbo/header/exhaust modifcation was almost 3X the cost of my car. So yes, I'm down for this.

[simple monkey]

I'm willing to learn and help. I don't have much experience with software, but i have a little with hardware if that helps. D-Cal, brilliant idea and i think this group is willing to over-clock the ECU like you're talking about, just not everyone is capable of doing it themselves like some of you. I think during the summer, or the next big vacation would be an opportune time for people to learn this stuff. I currently am juggling soccer and school, and soon a part time job, but i am still willing to help/learn. Hope i can help.

-Victor

[D-Cal]

I'm willing to learn and help. I don't have much experience with software, but i have a little with hardware if that helps. D-Cal, brilliant idea and i think this group is willing to over-clock the ECU like you're talking about, just not everyone is capable of doing it themselves

 

It's great that there is enthusiasm for this. I can't really help you guys much because a) I'm a total Subaru noobie, and I don't have an older EA82 model to work on or test.

 

You need a couple knowledgeable guys to step up and take charge. First, set yourself up a forum to work in. Either a message area here on the board, or better yet an entirely new forum with file and picture download/upload capabilities.

 

Next, someone needs to pull the calibrations from their computers and send them in. In the TD arena anyway, some MY cars used several revisions of calibration, and there was a pattern of code evolution from the beginning to the end of the 84-94 MY roadmap.

 

The OBD-II stuff is probably going to be an order of magnitude harder to decipher, so I would set your sights on the easier pre-ODB stuff first. Code based on the 8-bit ECMs.

 

Someone skilled with electronics can take a complete ECM and get it running in a test-bench situation. Hook up LEDs to the outputs and run some test code to identify what output is hooked up to what memory location. Figure out where the ADC/DAC input and outputs are. Use your FSM wiring diagrams to translate these into "OK, this is the ADC that measures the air intake temperature sensor".

 

Find a way to get test code into and running on the ECM. If you can build a flashable setup with a serial interface (maybe through the diagnostic/scanner port?) then that makes future tuning that much easier. Worse come to worst, you can get a device like the Romulator (www.xtronics.com), remove the stock EPROM and emulate it with a laptop. Then you can send in whatever you like, in addition to being able to monitor what memory areas the ECM is reading, in realtime while the car is running.

 

Take pictures of the differnet MY ECM boards and send them up. Examine the tops of the chips and write down the part numbers there. Use the internet and white papers to try and identify what chip they are. Manufacturers typically order chips with custom part #s on them to obscure what they are. You may have to guess using information like "I know the ECM has an 8 channel ADC, circa 1988 and it's probably Motorola stock with 28 pins". If you know what I/O package is installed, and you know the locations of some of the binary outputs, you can sometimes guess where the rest of the package is mapped into memory.

 

Examine the bus lines going to each chip. Sometimes you can guess the memory area the chip is mapped to by the configuration of the bus lines (though not always if it has an internal address decoder).

 

All of this hardware information feeds into the symbol table for disassembly I talked about. Once you start substituting all of the hardware ports with names like "ALTERNATOR_FIELD_CONTROL_BIT7" it gives context to the assembly language and becomes easier to understand what the code is doing.

 

Once you know how the code works, you can work on editing software. It can sometimes be as simple as an Excel spreadsheet with some custom macros. You can write your own from scratch like I have, or you can contact some of the people who market existing programs for other platforms, like www.tunercat.com from the GM arena. I am told some of those guys are receptive to expanding their market, you just have to give them the specs of how your ECM software works. They need to know how your table lookups work so they can program support for them. Sometimes it can be a simple (X,Y) table lookup, or it can require more complex interpolation math like the TD ECMs use. They use configuration files to map out where the editable data is, so you just fill in this table file and you get support from a fully functional editing program. What editing software you need will depend on how complex your code is. Won't know til you get there.

 

This is pretty much a roadmap to hacking your ECM. It's not going to be news to experienced hackers. Like I said, what you need is a couple of techie EA82 owners to step up and take charge, although there is room for anyone to contribute in terms of finding spare computers, scanning out ROMs, etc.

[MSSLGECKO]

D-Cal, thanks for taking the time to post on this for all of us who have no previous knowledge of this material to read!

This is pretty much a roadmap to hacking your ECM. It's not going to be news to experienced hackers. Like I said, what you need is a couple of techie EA82 owners to step up and take charge, although there is room for anyone to contribute in terms of finding spare computers, scanning out ROMs, etc.

If any of you guys who are familiar with this electro-hacking shenanegins are thinking that you could pull it off or at least take part in it, there are probably a bunch of USMB'ers that would be more than happy to assist with parts and $$ for your time, expertise, required parts, and food/drink to help the people with the tools to do it pull it off. I am one of those who is more than willing to assist in any way.

 

-this is probably the greatest thread ever-

[Dylan86GL10]

D-Cal, what's your name?

 

I was on SDML back since 97, then FMML, and started turbododge.com with Mike V before Ken took it over. I reversed most of the addresses in the 87 computers and did 3bar SMEC conversions and had a working xtronics emulator before it took a dump.

 

Sold the Shelby and the Neon just got a MSnS 'E for ease of configuration.

 

Wow, small world running into you here.

 

Dylan (formerly turbo electrics)

[WJM]

reflashing thread, RISSSSSEEEEEEEEEEEEEEEEEEEEEEEE!!!!!!!!!

 

I want reflash, damnit!