1996 Impreza EJ15 ECU "Z1"

[b3lha]

The warnings suggest that your linux PC does not have a working C compiler, headers and libraries installed.

But fortunately the executable that I compiled on my PC seems to run fine on yours. Next time you can forget the compile step and just run the program. I hope it works!

[seport]

CONGRATULATIONS PHIL

THE ECUEMU IS WORKING

[seport]

I had no luck trying the ecuemu with the evoscan cable (USB), but it did work with the ttl to rs232 interface via the 9 pin com port.

First attempt was with ROM ID: 703943, and it failed to communicate, although i tried all my available SSM cartridges, then I decided to enter mine, with ROM ID: 733F17 and loaded the first dump file which I dumped.
The communication was as if it is connected with the real ECU. No problems at all.

Then I started to browse through the different I/O's, find below the readings displayed on the SSM tool, most of them are zero but the dump file was being dumped with the engine shut off.

B Voltage      12.0V
V speed        0
RPM              0
Coolant        27 degC
ig timing       0
maf              0.02v
Load            0
Tps              0.54v
IPW              0
ISU              0
O2               0
O2 Max       0
O2 Min        2.55V
A/F Corr       0
Ex Temp sensor 603 degC

Attached is a copy of the complete activity

[seport]

Phil,

how can I open a .dat or .bin file with linux?

For the ecuemu to work, do you need the complete dump file?

I tried to open those dump files which i have with different RPM to see the starting address since I think that this is the load address which i have to enter in your program (ecuemu), but i didn't manage to open them.

Thank you

Alex

[b3lha]

Great! Actually I'm surprised at how well it is working. I expected a few more problems. I see one bug: the ecuemu reports "sending 000000" after the SSM sends "12xxxxxx" but actually it's not sending anything at that time.

You should be able to load those partial dump files at FB80. For example:

Code:

Enter ECU dump filename if required:ecu-fb80-to-ff7f-at-2000rpm.bin
Load Address:fb80

In fact you should be able to run the program without any dump file and it should just return a zero in every value.

I think for the next version I will add the option to edit memory values before starting the emulation. So you can set a parameter to a specific value and then see how the SSM interprets it.

You can view a binary file in linux using "xxd filename | more" but you probably don't have a hex editor installed. I was going to recommend you download "shed" from sourceforge, but it requires compiling and your C compiler seems to be broken.

It's a pity it didn't work with Andrey's ROM. It would be nice to find some parameters we don't already know. I guess it needs a different cartridge for that USSR ROM. Maybe you could try inventing some similar ROM ID like 703933 and see if it works?

1st character is always "7" on older cars.
2nd character is year rom was produced "0" for 1990, "2" for 1992, "3" for 1993, "4 for 1994" etc.
3rd and 4th characters seem to specify the car and engine type. For example: (25=SVX), (31,32,36,39=Legacy),(3F, 40=Impreza) Probably lots of others too.
5th character is market. "1" for JDM. "2" for USA. "3" for Europe. I guess "4" might be USSR.
6th character is ROM revision I think. Try 1,2 or 3.

I know from looking at the SVX cartridge that the select monitor does not check all of the digits of the ROM ID.

Anyway, thanks for working on this. Have fun with it and I'll try and improve it over the next few days.

Phil.

[seport]

Maybe you could try inventing some similar ROM ID like 703933 and see if it works?

I try as you are suggesting.

Should you know or have some ROM ID's and you need me to explore them (always if I have them available in my cartridges) please do send them to me, I will be glad to do it.

Alex

[seport]

I think for the next version I will add the option to edit memory values before starting the emulation. So you can set a parameter to a specific value and then see how the SSM interprets it.

This would be great! as it is very useful to find the conversion formula.

[b3lha]

5th character is market. "1" for JDM. "2" for USA. "3" for Europe. I guess "4" might be USSR.

Andrey tells me that his cars are originally from Germany. It was not possible to buy a Subaru in USSR at that time.

So "4" could represent German Model.

[seport]

Phil, I have tried several virtual ROM ID's similar to Andrey's 703943, but unfortunately I had no luck.

I also checked one of yours ROM ID:722515 and the parameters match perfectly with these: http://www.alcyone.org.uk/ssm/ecureverse.html.

Then I checked ROM ID:744014, and it works also, just in case the parameters are not known.
Here they are:
1335 battery voltage
1336 V. speed
1338 rpm
1337 coolant
1323 Ig timing
1307 MAF
1305 Load
1329 TPS
1306 IPW
1314 ISU
1310 Front O2
133A O2 max
133B O2 min
133E A/F Correction
1328 Knock correction
131E Turbo press
1340 Athmos. press
1341 Manifold abs. press
132B Exhaust Temp sensor

[seport]

I changed the I/O values of my original hex dump for 21 times, ranging from 0x00 to 0xFF and took a reading for each parameter with the SSM, all parameters are linear except for the coolant temp FBE5 and Ex temp FBE6. But for the coolant temp Phil found FC0D which is working fine (x-50).

so for all the other parameters we can use y=mx+c as described here: http://www.alcyone.org.uk/ssm/eavesdrop.html

Attached is an excel file with all data.

excel 2003 version attached also

[b3lha]

Nice work Alexander. Sorry I haven't finished the improved ecuemu yet. My new job is keeping me busy.

[seport]

Nice work Alexander.

Thanks

Sorry I haven't finished the improved ecuemu yet. My new job is keeping me busy.

No need to hurry, take your time. Currently the few hrs/ week available for myself, are being utilized in my carputer project.

[joseluizmartins]

Hi Folks ! Did you guys test some EPROM piggyback on this ECU ?

Due to HD6475328CP datasheet (page 299) we can replace the internal ROM with a external one, and fortunately our ECU board is almost ready to attach a socket.

I can do this test, but I'm affraid with checksum routine, once I didn't locate it.

Any gess ?

JL