1996 EJ20 Legacy ECU "T8"

[mrdjc]

Little update, I've decided I'll probably keep the vehicle (well, my mother will) so I'm going to become a tad interested again!

I've just bought a 1996 identical engined, identical coloured Legacy GL Estate, which has been converted to LPG, which is going to be spare parts..

Also something usefull for people, the Subaru Fast catalog, you can enter your VIN and it will tell you all the part numbers.
For example my vin is JF1BD5KJ3SG005662 enter it on there
Go to "Двигатель, топливная система " which is engine stuff.
Then Relay and sensor (096) and click on the "EGI Control".
You'll get a list (Manual Transmission for mine) of which ECU's could possibly be fitted and when.
It shows Mark seal: T8 and T9
I'm unsure what the "EK KA KK" stand for, possibly 3 connectors. the "K1" might just be one connector. Anyhow the site is here:
http://www.detali.ru/cat/su/su.dll

I hope that the donor car will have a T8 ECU so I can properly start messing around, and perhaps daughterboarding it!

Only one question to Phil.. For daughterboarding do I require a Rom writer, or is it possible to write it via serial?

Regards,
Daniel.

[b3lha]

Hey Daniel, nice to hear from you.

For these older cars you need a daughterboard and an eprom burner. A cheapo chinese one from ebay will do.

Phil.

[mrdjc]

Hi Phil, good to see your still around on this forum!

We picked up the other legacy yesterday from Aberdeen, it really has seen better days..

Good news, the ECU is identical to mine, I've dumped the ROM using the polaris software, it also has the same ROM ID as mine, 742FA1.

Is there a way to run both rom files next to eachother and show the differences between them?
I'm really curious to see if its identical to mine. I'm guessing a good place to start would be to compare the ignition and fuelling map.

It also has a Landi Renzo LPG system on it, which I might stick on my car, however it has its own ECU, which I have found the software for on internet  They want £50,- for a cable, but I found a nice guide on internet and can probably hook up my FDTI cable instead

Only weird thing is.. it also uses a lambda sensor apparently.. but I haven't found a second one yet.. and it also cuts into the injector circuit to switch them off when its running on LPG, and has an emulator to keep the ECU happy.

There is someone with a daughter board on the Uk legacy forum, but I'm unsure what exactly it is, it comes with no chips supplied.

The Chips you mention on your website I can't seem to find anywhere, altough there are some original EPROM chips for sale on a site in the UK for £3.75 each I believe.
But.. can these be re-written or do they need to be erased each time with the UV eraser?

There are no TOP2004 programmers on ebay anymore, only TOP2005 but i'm certain they are more or less the same, just a later revision.. Did you buy yours in from china? They are going for around £30,- plus £25,- postage, does that sound about right?

Another question, why do you require two chips on your daughterboard if they are twice as large as the originals? Can you switch between the two somehow?

Anyhow, hope to get back on topic again soon, but i've had way to much fun gutting the interior of the car.. all there is left is a steering wheel, the driver seat and seatbelt and the sound deadening carpet on the floor, everything else has gone! 

Hope your wife and little one are doing well, and your new job is treating you well.
Cheers,
Daniel.

[b3lha]

Hi Phil, good to see your still around on this forum!

We picked up the other legacy yesterday from Aberdeen, it really has seen better days..

Good news, the ECU is identical to mine, I've dumped the ROM using the polaris software, it also has the same ROM ID as mine, 742FA1.

Is there a way to run both rom files next to eachother and show the differences between them?
I'm really curious to see if its identical to mine. I'm guessing a good place to start would be to compare the ignition and fuelling map.

You could use a binary diff program, but if the ROM ID is the same then they should be identical.

It also has a Landi Renzo LPG system on it, which I might stick on my car, however it has its own ECU, which I have found the software for on internet  They want £50,- for a cable, but I found a nice guide on internet and can probably hook up my FDTI cable instead

Only weird thing is.. it also uses a lambda sensor apparently.. but I haven't found a second one yet.. and it also cuts into the injector circuit to switch them off when its running on LPG, and has an emulator to keep the ECU happy.

I don't know much about LPG systems. I remember seeing an SVX with one fitted and it didn't run properly on petrol or LPG. Not something I would do to my car.

There is someone with a daughter board on the Uk legacy forum, but I'm unsure what exactly it is, it comes with no chips supplied.

Sounds interesting. I'll take a look at it.

The Chips you mention on your website I can't seem to find anywhere, altough there are some original EPROM chips for sale on a site in the UK for £3.75 each I believe.
But.. can these be re-written or do they need to be erased each time with the UV eraser?

I've seen the chips for my board on ebay. Search for "27SF512".  The original eproms need a UV eraser. £3.75 is a good price if the chip works. I've seen them on sale for ten times that. Perhaps the demand has fallen because the cars are getting older and there are fewer around.

There are no TOP2004 programmers on ebay anymore, only TOP2005 but i'm certain they are more or less the same, just a later revision.. Did you buy yours in from china? They are going for around £30,- plus £25,- postage, does that sound about right?

Yeah. I'm sure it's the same sort of thing. Price seems OK. I don't remember whether you posted pics of your ECU. Does it have the upgrade socket on the board? My 96 legacy doesn't have the socket, but it does have a 28 pin connector which I suspect is for connecting a daughterboard.

Another question, why do you require two chips on your daughterboard if they are twice as large as the originals? Can you switch between the two somehow?

It's because the original EPROM sends the data 16 bits at a time. The EEPROM chips on the daughterboard can only send 8 bits at a time. So I use one chip to send the lower 8 bits and the other to send the upper 8 bits.

Anyhow, hope to get back on topic again soon, but i've had way to much fun gutting the interior of the car.. all there is left is a steering wheel, the driver seat and seatbelt and the sound deadening carpet on the floor, everything else has gone! 

Hope your wife and little one are doing well, and your new job is treating you well.
Cheers,
Daniel.

Thanks. Hopefully soon I'll be able to find some time to apply what I've been learning at work to my SVX  ECU project. I've been away from it for too long.
Phil.

[mrdjc]

The LPG idea has been ditched, its single point so its equivalent to throwing sticks of TNT into the air inlet system at random intervals.

I just compared the maps using Rom raider and your definition file you made, they are identical

I have the spare ECU lying next to me now, Something has occurred to me.
I am looking at the numbering.. you have the subaru part 22611 AB620 and A18-000 RV1 (Revision)
Then there's another 4 digits, I'm trying to work out if this is a date.. or a combination of date and number produced? This one says 4721 Which could be 1994, Month 7 Day 22.
My other one in my BD5 says 4922 Which could be 1994, Month 9, Day 22.

Can you take a look at any you have lying around to see if the last 2 digits exceed 31?
Also see if some boxes have 5 digits, indicating beyond the first 9 months of the year.

Otherwise it would mean that between the production of my vehicle and this one there were only 201 ECU's made (in 1994) I've found loads of markings all over the parts on the vehicle which suggest 1994 for manufacturing date.

I'm waiting for pictures/more info of this daughter board, its been offered to me at a very do-able price.

I am really keen to get on with all this stuff again, but its such a steep learning curve.  Hat off to you for learning everything off your own back.
I need some cash to get started again.. I need a decent soldering iron with a tip, not a 6MM flat stump.. also a sucker, 3rd helping hand, and all the bits I require.

Would it be possible to make your board slightly more complicated, and use the upper and lower bits of both chips, which could be switched between?  I have no idea how you get it to address to both chips, are they mirror images of each other? Or is the first 8 bits on one blank space, then last 8 bits on other chip blank space too?  Would it be possible to have 2 images which you could switch between, like a power and economy type of thing, but for a manual vehicle (as we don't have the power/economy button!)

Just opened the ECU case, the screws are a pain in the rear, they are loc-tite'd in place, resulting in damaged screws, I remember the same on the other one. I'll have to have a rummage around in my box of PC screws.

No socket.. just a row of dots. I don't see a J1 or J8 either. Im guessing I'll need to get two rows of pins and a modified board to connect, there are 28 holes, but they are spaced out like a connector, and not a ZIF socket. Any ideas?

Anyhow, better include a picture I did it on the scanner as I keep on getting Glare from the camera. Its High res so should help a bit.

How random.. It says max attachment 4096KB then when I submit it says 192KB max.

Off to Photobucket we go:
http://i219.photobucket.com/albums/cc137/Mrdjc/img119.jpg

Cheers,
Daniel.

[b3lha]

Good thinking on the numbering. I'll take a look at my ECUs and see if they fit the pattern.

That's the same ECU as my legacy. I alI haven't looked at it much. I suspect that you fit a connector to those solder dots and attach it to the daughterboard with a ribbon cable. I think that you probably have to remove a resistor to switch it between internal and external ROM. Probably that little brown surface mount one by the solder dots. It's easy to see which pin of the ECU it connects to, I'll look up whether that is the pin that controls which ROM is used.

You're right about the loctite on the screws being a problem. Computer CDROM mounting screws are the same size and thread (and inexplicably different to all the other screws in a computer  : )

[mrdjc]

I've just spent a painstaking hour staring and overlaying the front and rear images of the PCB, I removed the heatspreader and scanned in both sides at 1200DPI, then overlayed them in Corel Photo Paint, created a new layer and started using dots to trace circuitry.

I've not been able to find a pinout of this CPU at all, all I could find was Calums diagram here:
http://www.calumsult.com/calumsu/disassembler/SVX/GC8%20memory%20interface.pdf

I've tried to trace the pins, but its almost impossible, as they seem to go back on themselves underneath the CPU at angles, I ended up trying 3 of the through holes under the cpu, which could be connected to Pin 79 that come out the other side, on none of them can I find a resistor that leads directly to VCC with another jumper that leads to ground as per Calums diagram.

I also tried looking at the brown and black thing next to the 28 pins, all it does is it bridges VCC with VSS (whatever that is) which also happens to be pin 14 on the connector, which is ground. No idea why there are two, they are both on the same circuit.

Any suggestions are welcome

What exactly are the black, brown and green little blocks, some of them have numbers on them, are they mini resistors? Some start with C and others with R on the PCB writing.

I've ordered some header pins and sockets from Ebay, they were dirt cheap, and would save me using a ribbon cable.

Oh, do you mean the CD-Rom ones which look the same? The ones with a lip on the edge?
The "old school" CD-Rom ones, not the new fangled stumpy ones with a very narrow head?

I've got a big box here full of screws from my PC molesting days, so I should be able to find something.

Thanks,
Daniel.

[b3lha]

I've just spent a painstaking hour staring and overlaying the front and rear images of the PCB, I removed the heatspreader and scanned in both sides at 1200DPI, then overlayed them in Corel Photo Paint, created a new layer and started using dots to trace circuitry.

Could it be a 4-layer board? Sometimes they put power and ground connections in the middle layers.

I've not been able to find a pinout of this CPU at all, all I could find was Calums diagram here:
http://www.calumsult.com/calumsu/disassembler/SVX/GC8%20memory%20interface.pdf

There are some datasheets for similar processors in the same family at the bottom of this page.
http://www.alcyone.org.uk/ssm/ecuinfo.html
I don't really know what to say, I'm not very good at electronics. I'll take a look at my Legacy ECU and see if I can figure anything out.

I've tried to trace the pins, but its almost impossible, as they seem to go back on themselves underneath the CPU at angles, I ended up trying 3 of the through holes under the cpu, which could be connected to Pin 79 that come out the other side, on none of them can I find a resistor that leads directly to VCC with another jumper that leads to ground as per Calums diagram.

I also tried looking at the brown and black thing next to the 28 pins, all it does is it bridges VCC with VSS (whatever that is) which also happens to be pin 14 on the connector, which is ground. No idea why there are two, they are both on the same circuit.

Any suggestions are welcome

What exactly are the black, brown and green little blocks, some of them have numbers on them, are they mini resistors? Some start with C and others with R on the PCB writing.

The R ones are resistors, the C ones are capacitors. On some ECUs there are green ones with 000. They are 0-ohm resistors (jumpers). On the TCU, you have to move a 0-ohm from one place to another to enable the eprom socket.

[mrdjc]

Phil,

I just had a closer look, it appears to be only 2 layer. The Ground and VCC run mainly along the outer edge of the board, with branches coming off heading back in.

I'm sure your aware of the following, but I've been looking at how these resistor numberings work.

For example,
Resistors:
135 13 * ^5 = 13 0 0 0 0 0 = 1300K Ohms = 1.3 Mega Ohms
203 20 * ^3 = 20 0 0 0 = 20K Ohms
473 47 * ^3 = 47 0 0 0 = 47K Ohms
102 10 * ^2 = 10 0 0 = 1K Ohms
100 10 * ^0 = 10 = 10 Ohms

The capacitors on this board all appear to be the little yellow surface mount things.

Thanks for the link, I knew I had seen another pinout somewhere.
So its the NUA that controls which memory bank to use?
I looked it up and it means "Not Usable A" there is also a "Not Usable B"
No idea how they actually work..
If you connect them to ground they disable the selection? Or disconnect them from ground and connect them to VCC? Which is what calums diagram suggests?

I'll post up the new scanned images, but greatly reduced in size. Sadly the focus on the scanner works on the nearest part to the glass so the top view is a bit blurry. If you get a program you can use with layers, you can overlay them and draw dots, the rear one has been mirrored and flipped over, so they should almost match up.

I'm guessing a possible way forward is to Identify all the ground and VCC runs on the board, then start looking for parts of circuit which have a resistor and jumper going both to ground and VCC.

What exactly did you have to do to your TCU? Was it also removing a jumper from ground and placing it to VCC?

I'm tempted to go and strip the wiring loom down from this vehicle to the bare minimal required to run the ECU with all the sensors. Maybe even get it to run on a bench.
Also I have noticed something else whilst looking through manuals. The US versions (and manuals) seem to have a single plug ECU (Perhaps similar to the "T9" model as discussed earlier)

So.. If you have a minute, can you enter your Vin on the Subaru fast website, and look for your ECU part number, look at the description and see if it says something like "EK KA KK" (If you have 3 plugs) or "K1" if you only have one.. or something completely different if you only have two. This would confirm what EK KA and KK stand for.. as Mine has 3 plugs.. the Version in the manual has one big brown plug.. perhaps K1.


Front: http://i219.photobucket.com/albums/cc137/Mrdjc/t8Frontsmall.jpg
Rear: http://i219.photobucket.com/albums/cc137/Mrdjc/t8Rearmirrorsmall.jpg
Regards,
Daniel.

[mrdjc]

*Drumroll* Think I've found *something*

At the moment, Pin 1, 28 and 27 of the connector are "dud" as the circuit isn't complete.

Look at jumper R033.. its creating a circuit coming from that Motorola chip at pin 50 I believe (Is it a BIOS?)
The circuit however goes straight to ground.

If you were to remove that jumper from R033 and put it on R025's space, which is currently blank, the same circuit would presumably provide power to pin 1, 28 and 27 of the connector. If you look at my lines and look at the rear, you will notice that nothing else is feeding  off this circuit.

http://i219.photobucket.com/albums/cc137/Mrdjc/possible.jpg

So is this the part that "switches on" the external side.. If so.. do I also need to switch off the current memory chip, or will the Motorola chip detect the external memory and switch it over itself?

I take it the 2 little chips next to the CPU are 8 upper and 8 lower bit memory chips? Its not one big 16bit chip then?

*Edit* I'm on a Roll! Look what I found I've spent over 2 hours staring at this thing but never noticed.. probably as the overlay I was using was mirrored and upside down.
Looky here.. R24.. as per Calums diagram. And its 103 which is 10 000 = 10K Ohms.
http://i219.photobucket.com/albums/cc137/Mrdjc/T8R24.jpg

So presumably I would have to remove R19 to cut power to the memory and then move R033 to R025 to enable power to the external.

How about 3 dip switches wired onto the jumpers locations by which you can switch between original on board memory and external memory.. that would be ideal in case you mess something up and require to get home safely.

Regards,
Daniel.

[b3lha]

*Drumroll* Think I've found *something*

At the moment, Pin 1, 28 and 27 of the connector are "dud" as the circuit isn't complete.

Look at jumper R033.. its creating a circuit coming from that Motorola chip at pin 50 I believe (Is it a BIOS?)
The circuit however goes straight to ground.

If you were to remove that jumper from R033 and put it on R025's space, which is currently blank, the same circuit would presumably provide power to pin 1, 28 and 27 of the connector. If you look at my lines and look at the rear, you will notice that nothing else is feeding  off this circuit.

Nice work Daniel. I think you have found the answer, it looks like a similar arrangement to my TCU. You probably don't have to remove any R19 or anything else. It looks very likely that this resistor was designed to be placed in one slot or the other as a switch.

I was reading about another ECU, based on the same chipset, the M377xx has internal ROM, RAM and IO hardware. But apparently, when you switch to external ROM, you also need external RAM and IO hardware. That's what those other chips are for. If I understand it correctly, they do *nothing* when the ECU is operating in it's normal mode and are only used when you switch to external memory mode.

http://www.3si.org/forum/5124747-post105.html

I'll try and pull out one of my SVX ecus this week and see if the "external memory" resistor is wired to the same pins as those resistors on your ECU. Maybe that would help.

The dip switch idea is good, but you may have to also remove the daughterboard, so maybe the best failsafe is to keep a spare unmodified ECU handy.

[b3lha]

Would it be possible to make your board slightly more complicated, and use the upper and lower bits of both chips, which could be switched between?  I have no idea how you get it to address to both chips, are they mirror images of each other? Or is the first 8 bits on one blank space, then last 8 bits on other chip blank space too?  Would it be possible to have 2 images which you could switch between, like a power and economy type of thing, but for a manual vehicle (as we don't have the power/economy button!)

My board reads the first 8 bits from one chip and the next 8 from the other. But I program both chips exactly the same, it's just that half of the data on each chip never gets accessed. But there is still space for a second image. The chips are 64K and we only need 32K. In theory you just have to switch the highest numbered address line either high or low. This will swap addresses 0-7FFF with 8000-FFFF. Longassname on the SVX club has a board which does that, but I'm not 100% sure how to wire it, so I didn't do that on mine.

[mrdjc]

You probably don't have to remove any R19 or anything else.

I was reading about another ECU, based on the same chipset, the M377xx has internal ROM, RAM and IO hardware. But apparently, when you switch to external ROM, you also need external RAM and IO hardware. That's what those other chips are for. If I understand it correctly, they do *nothing* when the ECU is operating in it's normal mode and are only used when you switch to external memory mode.

If that's the case with these ECU's, how come Calums version didn't require this to be carried out?

Aren't the majority if not all of the JECS ECU's based on the same chipset? You never had to "enable" anything on your ECU I take it then, just remove R-19 to disable the onboard side?

If the Motorola chip doesn't do anything when its on internal memory, wouldn't the circuitry be more complex to enable it, or is it just sitting there waiting to get a signal from the external side so it can decide to use external over internal, like a BIOS?

It strikes me as odd if this is the case, they would be spending so much more on the ECU's production by adding materials and circuitry they don't really require.

It looks as if this ECU design is a real nightmare, no proper datasheets, no information on chips used. What are the other lines of solder for?

I've taken the whole ECU loom to bits, there's a few things I still need to figure out before i continue, i had to cut quite a number of wires headed for the blocks under the dash, which I'm unsure what they do yet. I'll hopefully be able to compare it to other manuals and the WRX ECU pinout.

Something interesting.. the Fuel Relay is hooked up to the ECU as well! (Its the only connector I recognised instantly, bright green! )

I guess I need to continue with the pinout, stick the ECU in a bench, and change readings where sensors are and see what adress in the ECU changes.

Also, there's another 1male and 1 Female plug which are the same as the Select Monitor plug, they are under the steering wheel somewhere. So I'll be stripping them off..
On another note, someone on the UK legacy forum has bought himself a Select Monitor kit which was on ebay.. I've tried to convince him to join this forum so we can make use of his investment!

Could you shed any light on what "Shield" is on the ECU Pinout? Its not ground.. so what in earth is it?

Many thanks for your help again.. The saga continues!

Cheers,
Daniel.

[mrdjc]

Think I've figured the shield part out now, its actual coaxial lined cable which most of the sensors use, its basically a ground but without directly being connected to ground, reducing noise.

Spent today hacking the ECU loom to bits, I can make a bench setup now I'm guessing.

Also created this:
http://home.zonnet.nl/mr.djc/T8Pinout.pdf

It might help other people figure their ECU out, its unlike any other diagram I've found on internet so far. The colors are completely different as are the pin numbers in use.

I found a matching manual page with the pin out on Bob Rawle's page. Over here: http://dspace.dial.pipex.com/bob_rawle/Ecu%20connection.htm

Cheers,
Daniel.

[b3lha]

If that's the case with these ECU's, how come Calums version didn't require this to be carried out?

Aren't the majority if not all of the JECS ECU's based on the same chipset? You never had to "enable" anything on your ECU I take it then, just remove R-19 to disable the onboard side?

If the Motorola chip doesn't do anything when its on internal memory, wouldn't the circuitry be more complex to enable it, or is it just sitting there waiting to get a signal from the external side so it can decide to use external over internal, like a BIOS?

It strikes me as odd if this is the case, they would be spending so much more on the ECU's production by adding materials and circuitry they don't really require.

It looks as if this ECU design is a real nightmare, no proper datasheets, no information on chips used. What are the other lines of solder for?

I suspect that when they are developing and testing the ECU software, they need to run the boards in external mode. This would allow them to make changes to the software, burn a new eprom, test them out and keep repeating the process until they decide it's ready to be released. Once the ECU is tested and working, they probably aren't going to make any big hardware changes.

I don't know what the other lines of solder are for. Maybe they use them when they program the internal rom at the factory. They have to get the program in there somehow.

I've taken the whole ECU loom to bits, there's a few things I still need to figure out before i continue, i had to cut quite a number of wires headed for the blocks under the dash, which I'm unsure what they do yet. I'll hopefully be able to compare it to other manuals and the WRX ECU pinout.

Something interesting.. the Fuel Relay is hooked up to the ECU as well! (Its the only connector I recognised instantly, bright green! )

I guess I need to continue with the pinout, stick the ECU in a bench, and change readings where sensors are and see what adress in the ECU changes.

Also, there's another 1male and 1 Female plug which are the same as the Select Monitor plug, they are under the steering wheel somewhere. So I'll be stripping them off..
On another note, someone on the UK legacy forum has bought himself a Select Monitor kit which was on ebay.. I've tried to convince him to join this forum so we can make use of his investment!

Could you shed any light on what "Shield" is on the ECU Pinout? Its not ground.. so what in earth is it?

Many thanks for your help again.. The saga continues!

Cheers,
Daniel.

A while ago I managed to download a factory service manual for this car with wiring diagrams and pinouts. But I think the only copy I had was on my work computer at my previous job :-(. I'll see if I can find it again.

Alexander in Malta has got a select monitor now and we wrote a program so that his laptop would pretend to be an ECU. We can choose what ROMID it reports to the select monitor and then see what address it queries for each parameter. So it's possible to pull out the parameter addresses for every ECU that the SSM cartridge supports.

It would be great if we could get a complete and accurate list of parameters for every car, but the difficulty seems to be in guessing the ROMIDs that the SM supports.