legacycentral bbs

Is there any interest in the legacy community to decode the ej22t ECU?
Something similar to
openecu.org
proposal: open ecu flashing project


I was able to find some links dated about a year ago discussing the eprom that the ecu have.

Tuning the stock turbo legacy ECU

Factory ECU chipping effort...

ECU codes galore



I have the rom image from an ej22t turbo 1991 ECU, if any want to take a look at it.

Has anyone had success identifying map locations, MAF transfer function, etc..?

I recently joined the Subaru world, I come from the Nissan world where ecu hacking and modifying has been around for a long time, I am surprised that I haven’t been able to find more info on the ej22t ECU especially when it is just asking to be hacked.

I do understand that there are not that many 91-94 legacy turbo out there so not a large community and not that much interest. But maybe we can give it a try do joint venture, if there is enough interest.

its all being discussed in the first link you posted.

as for stright hacking it. its unpossible. as far as chipping, please join teh discussion in nico's thread

here are two links you should read

http://www.rslibertyclub.org/forums/sho ... hp?t=58031

http://www.rslibertyclub.org/forums/sho ... hp?t=52599 (13 page thread)

There is an interest.....definitely!!

You may want to check out this thread as well. There's a lot of info in it, even though it's talking about developing a piggy back option
T-leg Piggyback ECU R&D

thank you for the links.

What I would like to be able to do is to change the Maf and injectors without having to use a piggy back computer. In the Nissan world that is usually accomplish by changing the K value and/or MAF transfer function in the rom. And from what I can tell so far the ej22t ecu is similar to a certain degree to the Nissan Ka24e one. the hard part is to find them values and ratios in the rom images.

Vgr3,
http://www.graphics.cornell.edu/~v/pics.cgi/aa694.gif

Any chance of sharing how you came up with this graphs[/url]

What you're looking to do is exactly what I would like to be able to do as well. Swap MAF sensor and injectors, and run the stock ECU.

I was able to find datasheets on the two main chips
HD63140 Universal Pulse Processor (UPP)
HD63B03Y CMOS MPU (micro Processing Unit)
http://www.datasheet4u.com/search.php

Hey, I'm sorry I've been slow to respond to your messages, not8player.

That's cool that you want to do what Josh and I have been talking about. We thought it would be neat to just modify the MAF transfer function to that of a JECS sensor (which has a much larger range than the stock EJ22T sensor) and the injector calibration to match modified 92-94 NA injectors (which have much greater flow rates than stock EJ22T injectors). Things would all be still pretty much OEM.

I pulled the data graphed there by using the Select Monitor port and reading the entire memory space byte by byte, and then looking for patterns in the result.

I have not had time to work actively on this project, which is unfortunate because I had a good deal figured out but I've forgotten a lot of it at this point.

Let me see if I can find stuff I had worked on before. I did identify the MAF transfer function and actually did accomplish something in terms of disassembling the code itself.

vrg3,
I started playing with dasmx130 to disassemble the code but my assembly skills are really rusty. So any notes or thought that you are willing to share would be greatly appreciated.
The MAF transfer function do you have the memory location for it? How large (How many points) was the table?

DASMx is what I was using as well. It seems pretty good. Just keep going back and filling in address labels as you figure things out.

The MAF transfer function is somewhere near the beginning. 64 16-bit entries if I recall correctly.

Try this: Render the 32-kilobyte ROM dump as a grayscale image. 16 pixels wide and 2048 pixels tall, with each intensity representing the value at that address. Then you can use your brain's built-in pattern matching technology to find maps and such.

vrg3,

I believe I have found the MAF transfer function at address 820h of the ROM dump.

I have been playing with a program called Analyser.exe that does something similar to your suggestion of doing a grayscale image.
http://www.pgmfi.org/twiki/bin/view/Library/NicoAnalyze

Do you have a list of Parameter Addresses (Selector Monitor Protocol) for the turbo ecu something similar to http://www.apps44.dsl.pipex.com/scoobym ... tocol.html

I was looking at the source code for the scanner software b10scan-0.06
I am not sure if I am interpreting the code correctly, is the Airflow signal (hitachi_qa) store in memory location 1400h?

Vrg3,
you can ignor my previous question i think i found the answer
http://www.vwrx.com/selectmonitor/SelectMonitor.ini

subscribe.

i would definately be interested in something like this.

As would I.

If I could tune my stock ECU for <$200, I'd be all for it.

Anyone out there with assembly coding experience that wants to help disassemble the code or someone that has gone down this road before that wants to share their findingr with the rest of the community. I pretty much have everything in place references, datasheets, rom image, software, eprom burner, romuletor, etc.. One thing I don’t have yet is actually an ej22t engine running inside a car, but do have one on an engine stand.

You should look at the source to my scantool, rather than that INI file. The stuff there is copied from my code but the transfer functions aren't all correct. Look under turbo_params. That will help a good deal with seeding a DASMx disassembly. I wish I could be of more help right now. I'll still try to get you my disassembly notes.

I used the ini file just confirmed the address locations and my understanding of your scan tool code. I was having difficulties understanding the way you compose the query string and send it via the parallel port. I would really love to see your notes on this.

Below I am attaching part of my sym file for Dasmx. Is still in it infancy and probably has mistakes.


cpu 6303
numformat C
org 0x8000
vector 0xFFFE reset_v
vector 0xFFFA SWI_v
vector 0xFFF8 IRQ1_v
vector 0xFFF6 IRQ2_TIC_v
vector 0xFFF4 IRQ2_TOC_v
vector 0xFFF2 IRQ2_TO_v
vector 0xFFF0 IRQ2s_IO_i_v

byte 0x0000 Port1DDR
byte 0xE50B store_Port1DDR_X14B9
byte 0x0001 Port2DDR
byte 0x0002 Port1
byte 0x0003 Port2
byte 0x0004 Port3DDR
byte 0x0005 Port4DDR
byte 0x0006 Port3
byte 0x0007 Port4
byte 0x0008 Timer_CS_R1
byte 0x0009 FreeRunCou_MSB
byte 0x000A FreeRunCou_LSB
byte 0x000B OutComR1_MSB
byte 0x000C OutComR1_LSB
byte 0x000D InCapR_MSB
byte 0x000E InCapR_LSB
byte 0x000f Timer_CS_R2
byte 0x0010 Rate_Mode_control_Register
byte 0x0011 Tx_Rx_Control_Status_Register1
byte 0x0012 Recive_data_Register
byte 0x0013 Transmit_Data_Register
byte 0x0014 Ram_Port5_Control_Register
byte 0x0015 Port5
byte 0x0016 Port6DDR
byte 0x0017 Port6
byte 0x0018 Port7
byte 0x0019 Output_Compare_Rgister2_MSB
byte 0x001A Output_Compare_Rgister2_LSB
byte 0x001B Timer_Control_Status_Register3
byte 0x001C Timer_2_Up_Counter
byte 0x001D Tx_Rx_Control_Status_Register2
byte 0x001E Test_Register
byte 0x001F Port5DDR
byte 0x0020 Port6_Control_Status_Register

byte 0xfffe romid_param
byte 0x1404 hitachi_vb
byte 0x154b hitachi_vsp
byte 0x140b hitachi_erev
byte 0x1405 hitachi_tw
byte 0x1489 hitachi_advs
byte 0x1400 hitachi_qa
byte 0x1414 hitachi_ldata
byte 0x1487 hitachi_thv
byte 0x1453 hitachi_tps
byte 0x15f0 hitachi_tim_t
byte 0x158a hitachi_isc
byte 0x1403 hitachi_o2r
byte 0x1488 hitachi_alphar
byte 0x1530 hitachi_rtrd
byte 0x144d hitachi_wgc
byte 0x1516 hitachi_barop_t
byte 0x00be hitachi_manip
byte 0x15a8 hitachi_fa0_t
byte 0x15a9 hitachi_fa1_t
byte 0x0019 Output_Compare_Rgister2_MSB
byte 0x001A Output_Compare_Rgister2_LSB


symbol 0xE4B8 Speed_Limit_funct
Symbol 0xF76C Store_Ve_Speed

Damn I feel dumb right now.

Binford wrote:Damn I feel dumb right now.

you are not the only one. ( I am doing a lot of head scratching) I might start loosing my hair


check this page out this guy did a really good job with documentation and the RX7 ecu is similar to ours (ej22tECU)

http://www.16paws.com/ECU/

Damn....That's crazy....that guy must know his shit!!!

Wow, yeah, that ECU is indeed a lot like ours. Doesn't seem to use the HD63140CP, though. I kind of feel like understanding that chip will go a long way towards understanding the code.

But, yeah, much of his .sym file will apply. Neato!

Props to that dude. He put a lot of work into tracing everything.