1996 Impreza EJ15 ECU "Z1"

[seport]

The best thing is to cross check the ecu connectors with the manual. The service manual that I have is for the european versions and it name the 2 ecu connectors as B44 26pin and B43 22pin.

It does not cover the EJ15, although similar in most items it is better that i check.  I will also take some pictures of the connectors.

What are your plans?

[b3lha]

It's not very important to know the exact wiring. I am just trying to understand the various inputs and outputs of the ECU. Each one will be connected to the CPU IO subsystem in some way.

The CPU datasheet shows up to 57 binary (on/off) type inputs and outputs. Then 8 channels of A/D conversion (voltage level inputs), 3 counters that can either count the time between input pulses or generate output pulses at specified intervals. 3 PWM timers that can generate pulses of specified intervals. Plus a few other things, for example, IRQ lines that generate an interrupt when a binary pulse is received.

If I can work out how the ECU inputs and outputs relate to the CPU inputs and outputs then I can label them in the program code, which may make it a little easier to understand how it works.

If the above list is correct then I have:

Inputs
=====
Speed Sensor - on/off or pulse counter
Crank Sensor - on/off or pulse counter or IRQ
Cam Sensor - on/off or pulse counter
Starter Switch - on/off
Neutral Switch - on/off
A/C Switch - on/off
AT/MT ident - on/off
Read Memory - on/off
Test Mode - on/off
Power Steering Switch - on/off
Coolant Temperature Sensor - voltage A/D
Throttle Position Sensor - voltage A/D
MAF Sensor - voltage A/D
O2 Sensor - voltage A/D

Outputs
======
Radiator Fan relay 1 - on/off
Radiator Fan relay 2 - on/off
Fuel Pump - on/off
A/C Relay - on/off
Self Shutoff - on/off
Malfunction Indicator - on/off
FICD Solenoid - on/off or pulse generator
EGR Solenoid - on/off or pulse generator
Purge Solenoid - on/off or pulse generator
Injectors 4 x on/off or pulse generator
Ignitors 2 x on/off or pulse generator
Idle Solenoid 2 x on/off or pulse generator

Having looked at this and done some research, I realise that the idle solenoid is more complex than I was expecting. I thought it was a simple on/off duty cycle but it appears to have one signal to pull it open and another to pull it closed.

I also realised that there are only two signals to control the ignitors. I was expecting four. My SVX ECU uses six and can therefore fire each of the six spark plugs independantly. But I think your ECU fires "Both Left" or " Both Right".

[b3lha]

Looking at how the program configures the Data Direction Registers for the binary I/O ports. I can see the following:

Port 1: OOOIIIII
Port 2: ...OOIIO
Port 3: OOOOOOOO
Port 4: OOOOOOOO
Port 5: III0II0I
Port 6: ....IIII
Port 7: OOOOOIIO
Port 8: --------
Port 9: OOOOOOOO

(I will edit the list below as I find more)

Port 1 address FF82
================
bit 2 (0x04) = Read Memory Connector
bit 3 (0x08) = unknown input
bit 4 (0x10) = Speed Sensor Pulse

Port 2 address FF83
===============
bit 1 (0x02) = unknown input
bit 2 (0x04) = unknown input

Port 3 address FF86
================
bit 0 (0x01) = unknown output
bit 2 (0x04) = unknown output
bit 3 (0x08) = unknown output
bit 5 (0x20) = unknown output
bit 6 (0x40) = unknown output

Port 4 address FF87
================
bit 0 (0x01) = unknown output
bit 2 (0x04) = unknown output
bit 4 (0x10) = Malfunction Indicator Light (Check Engine)
bit 5 (0x20) = unknown output
bit 6 (0x40) = ignitor
bit 7 (0x80) = ignitor

Port 5 address FF8A
================
bit 0 (0x01) = PAS ?
bit 2 (0x04) = AT/MT ident ?
bit 3 (0x04) = Test Mode Connector
bit 5 (0x20) = Neutral Switch
bit 6 (0x40) = A/C ?
bit 7 (0x80) = Starter Switch ?

Port 7 address FF8E
================
bit 4 (0x10) = unknown output

Port 9 address FFFF
================
bit 5 (0x20) = unknown output


ADC Channels (voltage inputs)
======================
1 - Battery Voltage
2 - Coolant Temp Sensor
3 - O2 Sensor
4 - TPS
5 - Unknown
6 - MAF

Timers
=====
FRT1 OCA - Unknown
FRT1 OCB - Injector Pulse ?
FRT2 OCA - Unknown
FRT2 OCB - Unknown
FRT3 OCA - Unknown

[seport]

I found this. Is it anything like your wiring?

this might be for the turbo model, mine does not have for instance a cam sensor.

from the picture of the EJ15 ecu (attached) it claearly shows that it has 2 connectors 22 and 26 pin.

[seport]

Having looked at this and done some research, I realise that the idle solenoid is more complex than I was expecting. I thought it was a simple on/off duty cycle but it appears to have one signal to pull it open and another to pull it closed.

I also realised that there are only two signals to control the ignitors. I was expecting four. My SVX ECU uses six and can therefore fire each of the six spark plugs independantly. But I think your ECU fires "Both Left" or " Both Right".

The idle solenoid valve mentioned in the forum is for the turbo model which uses double acting valve and of course uses 2 ecu outputs (pin d2 black and d1 white). The one used for the non turbo is a single acting valve, spring return and use only 1 output (pin a2 pink).

The same goes for the ignitor, the non turbo model has a twin double ended coil pack and use the waste spark system, thus having only 2 ecu outputs (pin b21 yellow/blue and b20 green/white).

[seport]

Looking at how the program configures the Data Direction Registers for the binary I/O ports. I can see the following:

Port 1: OOOIIIII
Port 2: ...OOIIO
Port 3: OOOOOOOO
Port 4: OOOOOOOO
Port 5: III0II0I
Port 6: ....IIII
Port 7: OOOOOIIO
Port 8: --------
Port 9: OOOOOOOO

(I will edit the list below as I find more)

Port 1 address FF82
================
bit 2 (0x04) = Read Memory Connector
bit 3 (0x08) = unknown input
bit 4 (0x10) = Speed Sensor Pulse

Port 2 address FF83
===============
bit 1 (0x02) = unknown input
bit 2 (0x04) = unknown input

Port 3 address FF86
================
bit 0 (0x01) = unknown output
bit 2 (0x04) = unknown output
bit 3 (0x08) = unknown output
bit 5 (0x20) = unknown output
bit 6 (0x40) = unknown output

Port 4 address FF87
================
bit 0 (0x01) = unknown output
bit 2 (0x04) = unknown output
bit 4 (0x10) = Malfunction Indicator Light (Check Engine)
bit 5 (0x20) = unknown output
bit 6 (0x40) = ignitor
bit 7 (0x80) = ignitor

Port 5 address FF8A
================
bit 0 (0x01) = unknown input
bit 2 (0x04) = AT/MT ident ?
bit 3 (0x04) = Test Mode Connector
bit 5 (0x20) = Neutral Switch
bit 6 (0x40) = unknown input
bit 7 (0x80) = Starter Switch ?

Port 7 address FF8E
================
bit 4 (0x10) = unknown output

Port 9 address FFFF
================
bit 5 (0x20) = unknown output


ADC Channels (voltage inputs)
======================
1 - Battery Voltage
2 - Coolant Temp Sensor
3 - O2 Sensor
4 - TPS
5 - Unknown
6 - MAF

Phil, now I am lost .
I did not understand a thing from this post. Are these useful to activate certain outputs individualy or monitor the inputs by using the "Hex Com Tool software"?

[b3lha]

I found this. Is it anything like your wiring?

this might be for the turbo model, mine does not have for instance a cam sensor.

from the picture of the EJ15 ecu (attached) it claearly shows that it has 2 connectors 22 and 26 pin.

Thanks for the wiring diagrams. I have updated the pinout above so that it is correct. Thank you also for the information on the (lack of) cam sensor and the functioning of the Idle Solenoid.

[b3lha]

Phil, now I am lost .
I did not understand a thing from this post. Are these useful to activate certain outputs individualy or monitor the inputs by using the "Hex Com Tool software"?

Sorry to confuse you. That post was only really intended for my future reference. It shows how the ECU input and output connections are mapped into the IO subsystem of the CPU.

You are absolutely correct that you could monitor the inputs using the Hex Com Tool, if you want to do that. For example, if you query the address FF8A then you should see the value change as you move the gearstick from Neutral or if you connect the test mode connector. If you make a note of the values and convert them to binary you should see a single bit that switches from 0 to 1 as the switch turns on or off. If you explore the unknown inputs then you may find the a/c or power steering switches.

You are also correct that, in theory, you can activate the outputs by writing data directly to them. But in practice the ECU is constantly writing it's own "correct" value to them several times a second. For example, if you write a 1 to turn on the radiator fans, the ECU will have overwritten it with a 0 before anything noticable happens.

[seport]

Phil, now I am lost .
I did not understand a thing from this post. Are these useful to activate certain outputs individualy or monitor the inputs by using the "Hex Com Tool software"?

Sorry to confuse you. That post was only really intended for my future reference. It shows how the ECU input and output connections are mapped into the IO subsystem of the CPU.

You are absolutely correct that you could monitor the inputs using the Hex Com Tool, if you want to do that. For example, if you query the address FF8A then you should see the value change as you move the gearstick from Neutral or if you connect the test mode connector. If you make a note of the values and convert them to binary you should see a single bit that switches from 0 to 1 as the switch turns on or off. If you explore the unknown inputs then you may find the a/c or power steering switches.

You are also correct that, in theory, you can activate the outputs by writing data directly to them. But in practice the ECU is constantly writing it's own "correct" value to them several times a second. For example, if you write a 1 to turn on the radiator fans, the ECU will have overwritten it with a 0 before anything noticable happens.

Thanks for your reply, this settled a bit my mind .

One question, was your previous job with FHI as a programmer? You are doing great

[b3lha]

One question, was your previous job with FHI as a programmer? You are doing great

LOL. I wish I could have that job.

I think that the injector pulse width is a 16bit value at FD96. For Evoscan you can use the 8bit value at FD1D and multiply it by 10. It should give the same result.

The value at FD96 is calculated by Function1D17 by adding together at least 11 different adjustments. I can see that it has a minimum value of 100 and a maximum of 2000. The problem now is to convert it to milliseconds.

The ECU uses the value at FD96 to program the "Output Compare B Register (OCB)" of "Free Running Timer 1 (FRT1)". I think the program turns on the injector and sets the timer to turn it off at "current time"+@FD96.

The program sets the FRT1 clock to run at 1/32 of the system clock. But we don't know the speed of the system clock.

Fortunately I can work out the speed of the system clock by looking at the baud rate generator. We know the baud rate of the select monitor is about 1953. The datasheet says the baud rate is calculated using the formula: BAUD=OSCx10⁶/[64x2²ⁿx(N+1)] The ECU code sets n=0 and N=159. Working that formula backwards we get OSC=20Mhz. If the system clock is 20MHz then the FRT1 clock must be running at 20/32=0.625Mhz.

Therefore each tick of the FRT1 clock is 1/625000 seconds = 0.0016ms. If I have worked this out correctly then the minimum pulse width would be 0.16ms and the maximum would be 3.2ms. The formula for Evoscan would be (@FD1D x 10)/625. Looking at your 1500rpm and 3000rpm dumps, the 1500rpm gives 1.168ms and the 3000rpm gives 1.44ms.

The Impreza service manual I downloaded says that the IPW should be between 1.5 and 2.1mS at idle. But I think that is for the 2.0 turbo model. I think it must be in the right ballpark, as they say in America. If we imagine an engine running at 6000rpm then each cylinder is firing every 20ms, therefore the intake stroke is 5ms, so a maximum IPW of 3.2ms sounds right to me.

[b3lha]

Latest version of the code for reference

[seport]

IPW as my manual should be between 1.5 and 3.5 ms. What is strange is that although it specifies the conditions, and one of them is "idling after warm-up", it still gives you the full range as specified data. Thus I assume that at idling it should be 1.5 ms. And Maximum should not exceed 3.5ms.

[seport]

I will test (@FD1D x 10)/625 for IPW this afternoon.
One have to remember that the 1500rpm and 3000rpm dumps where without load, I assume that the IPW will increase with load.

[seport]

I checked FD1D for injector pulse width using the formula *X10/625, and seems to me that make sense. The only concern that I have is that is drops below 1.5 ms during idling. However it looks as it is behaving as expected, when the engine load increases it also increases.

Very good job Phil , Thank you.

attached log file to view the results.

[b3lha]

The evoscan log looks good. I think it is probably right, but I share your concern that it drops below the value specified in the manual. I will try to follow the IPW calculation backwards to check that it is related to the AFR map I posted earlier.