Launch control for 1993 to 1996 Impreza WRX

[pmugabi]

I have been able to implement launch control on a Z5 ECU (1995 WRX RA) and I'd like to share the process for anyone interested. The launch control is based on a stationary rev limit which is removed when the car goes above a set speed (set to 10km/hr for my case). First I will list the resources I used to get to this point:

1. Phil Skuse's site (http://www.alcyone.org.uk/ssm/) provides very useful information on the SSM protocol, has reverse engineered code for a Z4 ECU and describes how to 'chip' the ECU
2. Limitless.co.nz for an SSMI cable
3. Mcumall.com for the 27C1028 chips, an adapter for them, EPROM eraser and programmer. Their programmer is about 1/4 the cost of the next cheapest programmer that can burn these chips.
                                                                   
The launch control code is quite simple. Instead of the ECU jumping to the rev limit code, the address is modified so that it jumps to the launch control code. The launch control code then checks if the vehicle speed is below the set limit, if it's above it the real rev limit code is called otherwise the launch control code now checks for if the RPM is above the launch RPM. If it is, it engages a hard RPM cut, I believe it's a fuel cut. Below is the code.

First of all the code at C841 is changed to point to the launch control code.
00C841    jsr     0xff23  ; instead of jsr 0xd5a5 which is rev limit code                                                                 

FF20 is an 8 bit value for the vehicle speed (divided by 2) at which the launch control is disabled
FF21 is a 16 bit value for the max launch RPM divided by 12.5                                                                             

Starting from FF23 we have the following code:                                                                   

LDA AL,0x116D  ;Value is km/h divided by 2
CMP AL,0xFF20    ; Compare vehicle speed to launch control disable speed
BCC 0x03         ; I'm too lazy to calculate the branch position. I'll just write the number of bytes the branch skips
JMP 0xD5A5       ; Run real launch control code since we are above LC disable speed
LDX 0x1066  ; Value is RPM/12.5
CPX 0xFF21  ; Are we at the launch control RPM? 
BCS 0x03 
JMP 0xD5A5  ; We are below launch control RPM, jump to real Rev limit code
SEB #0x08, 0x1154  ; Enable launch control rev limit, I could have done the 2 SEBs in one statement but I'm feeling lazy        SEB #0x43, 0x1154
RTS         ; Return

I've attached my ECU image with the launch control enabled at 5000rpm. The code for the Z4 and Z5 ECUs is the same, only the maps change. In case your ECU code is very different (i.e. C841 does not jump to rev limit, 116D is not vehicle speed and 1066 is not RPM), you can copy over your timing, fuel and boost maps to the Z5 image and use that.

[bubba2533]

This may be a stupid question, but is the Z4,Z5 ECU a JECS or Hitachi or neither?

[pmugabi]

It is a JECS ECU

[bubba2533]

So, you had to remove the original chip, erase it, then program it and replace it back into the ecu.

I did not know this was possible on the JECS ECU, maybe this is just true for non USDM JECS ECU's?

[pmugabi]

Phil's site explains the procedure, you cut a link on the ECU and then install the chip in the socket (mine had the socket but some ECUs only have solder pads and need the socket to be added).