Keywords: Fuel-Injection ECU EFI SUBARU WRX Impreza STI M37700 M37781 MELPS7700.

Analyze information of ECU for SUBARU EJ20

ec2-54-80-10-56.compute-1.amazonaws.com , 44427th 1999/10/18 UPDATED

NO WARRANTY
UNDER CONSTRUCTION


NOTICE

Analyze information of APEX PowerFC for GC8
MELPS7700 disassembler
SUBARU ECU monitor(U/C)
STi center diff controller photo

Analyzing diary

1996.4.1	got new car
1996.4.10	got underground ROM
1996.4.13	known waht is CPU
1996.4.18	got CPU users manual
1996.4.18	start making disassembler
1996.7.17	analyze communication interface circuit
1996.7.18	done disassembler, stating ROM analyze
1996.7.20	discoveried communication routines
1996.8.10	made RS232C adapter
1996.8.16	read ROM image from my car
1996.8.21	discoveried checksum routine
1996.8.23	discoveried address of the accell openity
1996.8.24	bought parts for make an external ROM board
1996.8.26	discoveried address of water temp
1996.9.5	discoveried address of air-flow
		speed limitter
		engine load
		R.P.M.
		start makeing external ROM board
1996.9.6	discoveried address of battery voltage
1996.9.11	done external ROM board, cut off speed limitter
1996.9.17	got information rev limitter, boost map
1996.9.23	starter SW, airconditioner SW, powersteering SW,
		D-test SW, ReadMemory SW, neutral SW,
		AccellPedal SW, Idleing SW
1996.9.25	ignition point, injector interval timer


about CPU

I seems that CPU is MITSUBISHI M377xx
disassembler for M377xx is available

How to use an external ROM

internal ROM goes disable at make high level at pin of "NUA". NUA is contacted to GND via jumper pin of J1. if you want to use an external ROM, cut a J1.

there is reserved socket for an external ROM, this socket is reserved for FUJITSU MBM27C1028. but, this ROM is already out of market. we can not get this ROM. so we must make an adapter of external ROM for 27C256.


prototype of external adapter
parts face
solder face

Reading internal ROM

there is the memory read connector at up allow of brake pedal. we can referencing internal memory by operation this terminal. SUBARU have the SELECT MONITER for diagnosis. they make a diagnosis contact this connector.

memory read connecter


interface voltage is TTL level(5V)

arround communication port in ECU



external view RS-232C level converter
schematic diagram RS-232C level converter

I analyzed program routine for communication, I found two commands read and write only. I seems SELECTMONITOR gets engine data is read from ECU work area direct.

communication format is, 1,953.6bps(CLK/2048) S8E1.

ECU detects end of command is counting received data length. ECU executes a command as soon as data received.

Command in binary mode(default)

command phase length +0 +1 +2 +3 description
memory read command 4 0x78 addr MSB addr LSB ' R ' read data from absolute memory. repeate until get another commands.
result 3X addr MSB addr LSB DATA -
memory write command 4 0xaa addr MSB addr LSB DATA write data to absolute memory
result 3 addr MSB addr LSB DATA - reread data from wrote address
clear command 1 0x12 - reset command phase
result 0 -
get ROM ID command 4 0x00 ' F ' ' H ' ' I ' get ROM ID
result 3 ID #0 ID #1 ID #2 -



Command in ASCII mode(optional)

command phase length +0 +1 +2 +3 +4 +5 +6 +7 description
memory read command 6 0x7f MSB LSB ' R ' - read data from absolute memory
result 8 addr MSB addr LSB DATA CR LF
memory write command 6 0x20 MSB LSB DATA - write data to absolute memory
result 8 addr MSB addr LSB DATA CR LF reread data from wrote address
clear command 1 0x12 - reset command phase
result 0 -


parameter address(no warranty)

IDnamedescA/D#monitor addrint addrunit
F01VBbattery20x13350x1046.wMon:E[V] = N * 0.08
F02
F03VSPspeed VSP0x13360x1075V[Km/h] = N * 2
F04EREVengine RPM0x13380x121c.wMon:R[RPM] = N * 25, internal:R[RPM] = 120000000 / N
F05
F06TWwater temp10x13370x1268.w
F07ADVSignition point0x1053BTDC[deg]
F08QAair flow signal00x13080x1042.w( Vadc = N / 200 )
F09LDATAengine load0x1305
F10THVthrottle signal40x13290x1262.wMon:THV[%] = N / 2.56
F11TIMinjector time width0x13060x10c0.w $1306 = $10c0.w / 64, $10c0.w * 4usec = real INJ time?, $1306 * 64 * 4 * 1000 = real INJ time[msec]
F12ISCISC valve duty
F13O2O2 sensor signal
F14O2MaxO2 sensor signal Max
F15O2MinO2 sensor signal Min
F16ALPHAA/F correction coefficient
F17RTRDignition point correction
F18WGCboost control duty
F19BARO.Popen air pressure50x1340P[mmHg] = N / 2 - 260?
F20MANI.Pcurrent boost50x13410x12c4.wP[mmHg] = N / 2 - 260?
F21
F22
F23EXTEMPexsaust temp
FA0.1IGIGN SW
FA0.3UDTEST SW0x1343:50x2200:1
FA0.4RMREAD MEMORY SW0x1343:40x2200:2
FA0.6ASACCELL SW0x1343:30x2200:6
FA0.7NTNEUTRAL SW0x1343:20x2000:0
FA0.9SSSTEERING SW0x1343:00x2200:7
FA1.1IDIDLE SW0x1344:70x2000:4
FA1.2ACAIR CONDITIONER SW0x1344:60x2000:1
FA1.3ARAIR CONDITIONER RELAY SW
FA1.4R1RADIATOR FAN1 SW
FA1.5R2RADIATOR FAN2 SW
FA1.6FPFUEL PUMP SW
FA1.8KSKNOCK SIGNAL
FA2.1MCN/A
FA2.2ICN/A
FA2.3BROPEN AIR SWITCH SOLENOID
FA3.10O2O2 MONITOR
[OTHER]
STARTER SW0x2000:2

E-mail [注意]不適正な題名は即座ゴミ箱、名前を名乗らぬ者への返事はしない事があります。フリー系メールからは自動的に拒絶する場合があります。
-- LINK FREE --
 
HOME LAST