1996 Impreza EJ15 ECU "Z1"

[b3lha]

Phil, could you update the first post to indicate OBD1?

I've updated it.

Alexander, is your car a european version or a japanese version? Is is a sedan or a wagon? Maybe you could post a picture so we know what car we are talking about?

[b3lha]

Alexander, Could you try FC0D for water temperature?

In Func3E2E, the ECU uses the signal value at FBE5 to lookup a graph (attached) stored at 7140. Then it stores the value in FC0D. I think this must be the Celcuis value.

00007140   FF C2 A4 94 88 80 78 72 6D 68 64 60 5C 58 55 51   ......xrmhd`\XUQ
00007150   4E 4B 48 45 41 3E 3B 37 34 30 2C 27 22 1B 13 06   NKHEA>;740,'"...

My SVX ECU also uses a 32byte graph to convert from signal to celcuis and the shape of the curve is very similar.

[b3lha]

This is how I found the rpm and engine load parameters. I didn't get around to writing about it yesterday.

Looking through the hex dump, I found what looks like timing maps at 6800 and 7800.

00007800   19 19 17 15 13 11 0F 09 04 01 00 00 00 00 00 00   ................
00007810   19 19 19 19 18 16 13 0F 08 04 02 00 00 00 00 00   ................
00007820   16 20 25 21 1E 1B 18 16 0F 0A 07 05 04 03 01 00   . %!............
00007830   19 25 2C 28 25 21 1E 1B 13 0F 0B 09 08 07 05 03   .%,(%!..........
00007840   1B 25 2E 2A 28 25 23 20 19 17 15 13 11 0F 0D 0B   .%.*(%# ........
00007850   1D 2A 33 32 30 2A 28 25 1E 1A 18 15 11 0E 0C 0A   .*320*(%........
00007860   20 2A 33 32 31 2B 29 26 1F 1D 18 15 12 0F 0C 0A    *321+)&........
00007870   23 2B 35 32 31 2C 2A 27 21 20 1B 18 16 15 12 10   #+521,*'! ......
00007880   25 2D 36 34 33 31 30 2E 2A 26 24 21 1E 1D 1C 1A   %-64310.*&$!....
00007890   2D 30 36 36 36 36 35 34 30 2D 2B 28 25 22 1F 1D   -06666540-+(%"..
000078A0   30 34 36 36 36 36 35 34 30 2E 2A 25 21 1E 19 18   046666540.*%!...
000078B0   30 35 35 36 35 34 33 32 30 2E 29 22 20 1E 1C 1A   055654320.)" ...
000078C0   30 36 37 37 36 36 35 34 30 2E 2B 28 23 21 1D 1C   067766540.+(#!..
000078D0   30 37 37 37 37 37 36 35 32 30 2F 2A 26 22 1F 1D   0777776520/*&"..
000078E0   30 37 37 37 37 37 37 36 32 30 2F 2B 27 23 22 20   0777777620/+'#"
000078F0   30 37 37 37 37 37 37 36 32 30 2E 2C 2A 29 28 27   0777777620.,*)('

Then I looked in the code and found that they are read by Func178B. In that function I found the location of the Xscale (6900) and the Yscale (6910) of these maps. On my SVX ECU, the Xscale is rpm and the Yscale is load. So it's a reasonable assumption that this is similar. I checked which variables were being compared to the scales. It looks like FBE8 is rpm and FC06 is load.

I am pretty sure that they are correct, and Alexander said they looked correct when he tested them.

See the maps attached. I'm not sure why there are two maps, or which map is used at any given time. That is outside the scope of the project.

[b3lha]

Following the error codes as before:

I think that the O2 Sensor reading is FBE3 and the minimum and maximum are at FC7A and FC7B.

I notice that the ECU does not have error code 22 for the knock sensor, does you car have a knock sensor?

[seport]

To clarify, the car used in this topic is a JDM 1996 Subaru Impreza CS Extra. (Engine EJ15). OBD1 which has a yellow 9 pin diagnostic connector.

Picture attached

Alexander

[seport]

Hi Phil,

thank you for your impressive work.

No this model does not have a knock sensor, if the last 3 parameters in your last post for the O2 sensor are correct then only the battery voltage and the injector pulse width remain. (i think).
I am now going to check the coolant temperature new address, confirm the speed address and O2 addresses.
I will be using evoscan now since I have no com port on my laptop.
Be back.

Alexander

[seport]

Phil,
Temperature address FC0D is the correct one in Deg.C, vehicle speed address FB95 is the speed in KM/h there is no need to multiply the value by 2 as is done in vwrx and evoscan software, for the O2 addresses they seem to make sense. I don't know wether it is normal that both the O2 max and O2 min returns to value 0 on engine brake. I know that the O2 sensor will flactuate between 0.1V and 0.9V. I need to do some more tests. If you know what to expect from these readings please advise.

attached find an evoscan screenshot

Alexander

[b3lha]

To clarify, the car used in this topic is a JDM 1996 Subaru Impreza CS Extra. (Engine EJ15). OBD1 which has a yellow 9 pin diagnostic connector.

Picture attached

Alexander

Nice looking car.

I thought it might be JDM because of your ROMID 733F17. I have noticed that JDM cars always have a 1 as the second last digit of the ROMID. USDM cars have a 2 and European cars have a 3. I think this digit refers to the domestic market of the car.

[b3lha]

Here's a unique feature of JDM cars, the 180km/h speed limiter

114D  15FB9480    MOV:G.B @H'FB94:16,R0
1151  1572A370    CMP:G.B @H'72A3:16,R0
1155  2506        BCS H'115D
1157  15FBC3C0    BSET.B #0,@H'FBC3:16
115B  200A        BRA H'1167
115D  1572A470    CMP:G.B @H'72A4:16,R0
1161  2404        BCC H'1167
1163  15FBC3D0    BCLR.B #0,@H'FBC3:16

A copy of the speed variable is in FB94 this gets compared to the data at 72A3 and 72A4

000072A0   FF FF FF B4 B2 00 00 FF 1E FF FF FF 14 A0 FF FF   ................

If the speed rises above 0xB4 (180km/h) then it sets bit 0 of FBC3. Which presumably activates the limiter elsewhere in the program. When the speed falls below 0xB2 (178km/h), it clears bit 0 of FBC3 and thereby deactivates the limiter.

If you ever find a way to reprogram this ECU then I would suggest setting these values to FF (255km/h) and FD (253km/h) or alternatively change the BSET to a BCLR in the code so that it never activates.

[b3lha]

Alexander,
I will check the O2 sensor addresses again and compare the behaviour to my car.
Phil.

[b3lha]

I think I have found the Battery Voltage. I made the assumption that the voltage must have been between 11 and 14 volts when you dumped the memory. I also assumed that this ECU uses the same formula as other ECUs. ie. volts=x*0.08

On that basis the value in RAM should be between 0x89 and 0xAF. So I made a list of all the addresses in the RAM that fell into that range. There were 9 in total. Then I searched for those addresses in the program code to see what they were used for.

I think the most likely candidate is FBE4. Could you test it please. Check the voltage reading. If it looks reasonable, turn on the headlights and stereo, it should drop a little bit. Then start the engine and it should rise a little bit.

[b3lha]

I found that Func0277 is for performing a 3D map lookup. Before calling, R5 points at an address containing a 8 byte structure. The first two bytes are a pointer to the map, the next two are a pointer to the x scale, the next two a pointer to the y scale. The remaining two are the size of the X and Y scales in bytes.

For example, this is a lookup of the Fuel map:

138A  15FBE883    MOV:G.B @H'FBE8:16,R3    ; RPM
138E  15FC0684    MOV:G.B @H'FC06:16,R4    ; Load
1392  5D7208      MOV:I.W #H'7208:16,R5
1395  180277      JSR @H'0277
1398  15FC2290    MOV:G.B R0,@H'FC22:16

00007200   65 00 69 20 69 30 10 10 66 00 69 C0 69 D0 10 10   e.i i0..f.i.i...

and here is the fuel map:

00006600   86 86 86 7D 77 73 75 7B 7C 7D 7A 70 70 70 70 70   ...}wsu{|}zppppp
00006610   86 85 85 81 7D 7E 7F 7F 7D 7C 7B 70 70 70 70 70   ....}~..}|{ppppp
00006620   88 7F 7F 80 81 80 7F 7E 7C 79 77 6D 6D 6D 6D 6D   .......~|ywmmmmm
00006630   88 7F 7F 85 83 7F 7E 7B 79 76 75 6E 66 66 66 66   ......~{yvunffff
00006640   88 84 84 86 84 7E 7A 7A 78 76 76 6E 67 67 67 67   .....~zzxvvngggg
00006650   89 84 85 88 81 80 7D 7C 7A 77 73 6F 6C 68 68 68   ......}|zwsolhhh
00006660   8B 86 88 88 84 7F 7E 7D 7C 7B 7B 78 74 6D 6D 6D   ......~}|{{xtmmm
00006670   89 83 83 86 83 7F 7E 7D 7C 7A 77 71 6B 6A 6A 6A   ......~}|zwqkjjj
00006680   88 82 82 86 82 80 7F 7D 7B 79 75 70 69 63 63 63   .......}{yupiccc
00006690   89 7D 7D 85 82 80 7E 7C 79 76 73 70 6C 69 69 69   .}}...~|yvspliii
000066A0   89 7F 7F 81 80 80 7D 7C 7A 77 74 71 6F 6A 6C 6C   ......}|zwtqojll
000066B0   88 82 82 84 83 81 7D 7B 78 76 73 71 6E 6D 6D 6D   ......}{xvsqnmmm
000066C0   8B 84 84 84 82 7F 7D 7B 78 76 75 73 71 71 71 71   ......}{xvusqqqq
000066D0   8C 86 86 82 7E 7B 7A 79 77 76 75 73 70 6B 6B 6B   ....~{zywvuspkkk
000066E0   8F 8F 8E 8E 88 80 7B 79 78 77 74 71 6B 66 66 66   ......{yxwtqkfff
000066F0   8D 8D 8C 8C 84 81 7C 7A 78 73 6F 6A 67 67 67 67   ......|zxsojgggg

Here are the X and Y scales:

000069C0   18 20 28 30 40 50 60 70 80 90 A8 B0 C0 D0 E0 F0   . (0@P`p........
000069D0   20 28 30 40 50 60 70 80 90 9E AC BA C8 D6 E4 F2    (0@P`p.........

And attached is what it looks when you plot it to a graph

Having discovered the function, I can find lots of other 3D maps by looking for calls to that function. The difficulty is in knowing what the maps represent.

[seport]

Phil,

Battery voltage address FBE4 is correct.

I made some more tests to confirm the O2 addresses, I was wrong when telling you that Max. and Min. return to value zero while engine brake. The correct statment should be that the avarage and Max. return to zero while engine break. O2 Min. reading is very high, most of the time above 1400mV.

Alexander

[b3lha]

I explained it wrong. FC7A is the maximum and FC7B is the minimum.  I'm sure these are correct because the processing looks similar to my SVX ecu.

FBE3 is the instant reading, not the average. I think that is a mistake in the VWRX software that got copied into Evoscan. The Subaru Service Manual shows it as an instant reading.

However, the formula may not be correct. Notice that in Evoscan and VWRX, they use different formulae. x*5000/512 for Avg and x*5000/256 for Min/Max. In your ECU all three should have the same formula, but I don't know what it is.

If neither of the above formulae give a sensible reading then the alternative is to measure the voltage with a voltmeter, compare to the ECU reading and work backwards to find the formula.

Phil.

[b3lha]

Time to take stock of where we are and what remains to do:

We have identified the following variables:

Throttle Position FC2B
MAF Sensor FBE0
Temperature FC0D
Speed FB95
RPM FBE8
Load FC06
O2 Sensor FBE3
O2 Maximum FC7A
O2 Minimum FC7B
Battery Voltage FBE4

I am still looking for:

Advance
Injector Pulse Width
Idle Solenoid Duty Cycle
Purge Solenoid Duty Cycle
AFR Correction

These ones are hard to find, but I will see what I can do.

Attached is my latest version of the ecu code with updated comments.