Notices
Series I Aftermarket Performance Modifications Discussion of power adding modifications

cracking the ecu....

Thread Tools
 
Rate Thread
 
Old Mar 23, 2006 | 03:46 PM
  #176  
Red Devil's Avatar
Registered User
 
Joined: Jun 2002
Posts: 3,086
Likes: 1
From: Misinformation Director - Evolv Chicago
UPS issue can be addressed by getting the package insured.

As for the forum bit*****, you've been around as long as I have. We both know that will never end. The first time a shipped-to-the-customer reflash unit malfunctions it will be the same as if one wasn't returned within the 3 day period.
Old Mar 23, 2006 | 04:20 PM
  #177  
Nemesis8's Avatar
Bigus Rotus
iTrader: (3)
 
Joined: Jun 2004
Posts: 8,573
Likes: 1
From: Missouri
Looks like they soldered something on the board here:

Old Mar 23, 2006 | 05:40 PM
  #178  
StealthTL's Avatar
Metatron
iTrader: (1)
 
Joined: Mar 2003
Posts: 7,286
Likes: 184
From: A Pacific Island.
Arrow Port....

Looks like just a port, for communicating with the board.

S
Old Mar 23, 2006 | 07:48 PM
  #179  
Hskr8's Avatar
Thread Starter
Registered User
iTrader: (1)
 
Joined: Dec 2003
Posts: 310
Likes: 0
From: Nebraska
back to the original idea, I wonder if they are tuning the complete car maps, or just the long term ones or both?

part of the reason the cz unit became problematic was because the long term maps would eventually defeat the tuning... so in converse, theory suggests if we could identify the long term section and modify that and flash it, the car would eventually steer towards the those long term values.
Old Mar 23, 2006 | 10:01 PM
  #180  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
the Astra unit has both it's pluses and minuses relative to reflashing, not sure I want to spill the beans just yet though ...
Old Mar 25, 2006 | 12:18 PM
  #181  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
The attached is some new finding.
Attached Files
File Type: zip
sw-n3z2ep000.map.zip (26.8 KB, 406 views)
Old Mar 25, 2006 | 12:30 PM
  #182  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
There is a connector left out in the circuit board. This should be a communication port for EPROM programming by connecting a jumper. ROM contents may be download and examine and can be put back the same way. This is the easiest way to do without having to deal with other limitation that the ECM re-programming module might have via the CAN network. But accessing to those software and tools are currently attainable only by professional according to my current knowledge.

Originally Posted by StealthTL
Looks like just a port, for communicating with the board.

S
Old Mar 25, 2006 | 12:40 PM
  #183  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
Once the main map is modified, the LTF will not be a problem. Base on what I see, there seemed to be some value reside close to the each map area that have some indication of its expected values; if not, they might as well be checksum bytes.

Originally Posted by Hskr8
back to the original idea, I wonder if they are tuning the complete car maps, or just the long term ones or both?

part of the reason the cz unit became problematic was because the long term maps would eventually defeat the tuning... so in converse, theory suggests if we could identify the long term section and modify that and flash it, the car would eventually steer towards the those long term values.
Old Apr 4, 2006 | 12:23 PM
  #184  
RX3+5's Avatar
Bullshit Detector
 
Joined: Oct 2004
Posts: 272
Likes: 0
From: Auburn, CA
Any news?

Vince
Old Apr 4, 2006 | 11:43 PM
  #185  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
The Borg Project is progressing ...
Old Apr 4, 2006 | 11:53 PM
  #186  
Hskr8's Avatar
Thread Starter
Registered User
iTrader: (1)
 
Joined: Dec 2003
Posts: 310
Likes: 0
From: Nebraska
I think the only way to go forward is to take an educated guess at a certain data spot, make a noticable change at a certain rpm data point... something out of the norm, figure a way to re-introduce the checksum to the file, flash the car, and compare to a stock set of logged data to identify what actually changed.

With this kind of hunt and peck approach it would take a little while at first, but could be doable. I would need to get the right tools to do this too. Of course having the software emulator like was shown in those video screen shots would make things allot easier and faster.
Old Apr 5, 2006 | 04:07 AM
  #187  
Rasputin's Avatar
Registered
 
Joined: Sep 2004
Posts: 581
Likes: 0
From: Europe
seikx8,

I had a proper look at your file yesterday night. I have a few comments.

I don't think what you identifed in a previous post as a spark advance table actually is one.
I found these two tables to be more in line with what to expect :

X-Axis: [0x7fc78 9x4]
0.125 0.2 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625
Y-Axis: [0x7fc9c 9x4]
500 1000 1400 2000 2500 3000 3500 4000 4500
Cells: [0x7fcc0 9x9x4]
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
17.82 17.82 19.80 17.06 16.95 16.84 19.38 17.02 15.66
17.53 17.53 16.08 15.26 18.31 17.07 16.04 20.04 17.76
17.59 17.59 22.59 18.83 16.38 18.67 18.12 18.86 17.97
18.06 18.06 25.14 18.45 18.89 17.67 21.62 21.62 21.62
19.36 19.36 22.95 18.71 18.13 18.55 20.17 20.17 20.17
19.36 19.36 22.95 18.71 18.13 18.55 20.17 20.17 20.17

X-Axis: [0x7fe10 10x4]
0.16 0.21 0.25 0.375 0.5 0.625 0.75 0.875 1 1.1
Y-Axis: [0x7fe38 17x4]
780 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000 6500 7000 7500 8000 8500
Cells: [0x7fe7c 10x17x4]
21.80 21.80 21.80 43.10 56.90 73.90 79.70 79.70 79.70 79.70
15.87 15.87 22.60 43.10 56.90 73.90 79.70 79.70 79.70 79.70
16.00 18.30 20.10 31.90 43.50 55.20 66.70 66.70 66.70 66.70
10.40 13.51 16.00 24.10 32.40 42.60 50.70 57.20 57.20 57.20
9.00 10.77 12.20 18.40 24.20 30.00 38.10 44.90 44.90 44.90
7.00 9.17 10.90 16.40 21.20 28.00 33.80 41.40 41.40 41.40
5.50 7.45 9.00 14.50 20.10 25.70 31.70 36.80 36.80 36.80
5.50 6.84 7.90 12.60 17.40 22.90 26.70 29.00 29.00 29.00
5.00 5.89 6.60 11.50 15.60 20.30 23.50 27.90 27.90 27.90
6.00 6.00 6.00 10.00 13.80 18.70 22.40 23.50 23.60 23.60
6.00 6.00 6.00 9.30 12.00 15.90 19.70 20.00 20.10 20.10
6.00 6.00 6.00 7.60 9.90 12.90 16.60 18.40 19.50 19.50
6.00 6.00 6.00 6.00 9.10 11.80 13.30 13.91 16.10 16.10
6.00 6.00 6.00 6.00 9.80 11.50 13.30 16.41 16.17 16.17
13.00 13.00 13.00 13.00 10.79 11.80 15.00 16.90 20.20 20.20
13.00 13.00 13.00 13.00 13.00 13.00 18.00 22.00 30.00 30.00
14.00 14.00 14.00 14.00 14.00 14.00 22.00 31.00 31.00 31.00

One must be for Leading, and the other one for Trailing plugs. Please feel free to comment.
This can be verified easily with a sCANalyser.

I also think these following 2 tables gives the range of authority (retard/advance clips) for the knock control :

X-Axis: [0x7dca8 20x4]
0.0625 0.125 0.1875 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625 0.6875 0.75 0.8125 0.875 0.9375 1 1.0625 1.125 1.1875 1.25
Y-Axis: [0x7dcf8 12x4]
500 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000
Cells: [0x7dd28 20x12x4]
2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30
2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40
2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.90 2.90 2.90 2.90 2.90 2.90 2.90
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00
2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75

X-Axis: [0x7e0f4 20x4]
0.0625 0.125 0.1875 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625 0.6875 0.75 0.8125 0.875 0.9375 1 1.0625 1.125 1.1875 1.25
Y-Axis: [0x7e144 12x4]
500 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000
Cells: [0x7e174 20x12x4]
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00
3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30
3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.80 3.80 3.80 3.80 3.80 3.80 3.80
3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75

Again, this can easily be checked.


Regarding the table identified as the fuel table, I don't believe it is the main fuel table (however, it can be a default fuel pulsewidth table in case of MAFS failure for example). Fuelling usually works this way on OEM products :
1) The quantity of air induced in the next stroke is estimated by a very complex dedicated strategy module that will basically also calculate a LOAD value. On the RX8, this estimation is essentially based on MAFS data.
2) The PCM then calculates the amount of fuel that's necessary to achieve the target lambda value (whether it is in open loop or close loop does not change this) . It derives a fuel pulsewidth from this amount of fuel.

You see, no base fuel maps with fuel pulsewidth in such a system. The only "fuel" tables actually define where the system works in open or closed loop, and the target lambda value.
Another point that could confirm this is the fact we only find one table that really looks like a fuel injector pulsewidth table (up to 28000). But we have three levels of injectors with independant fuelling patterns. We should therefore have 3 tables and 2 of them with "0" pulse width under 4000 RPM (SSV is closed).

So, what we're looking for, in order to modify fuelling is :
- an open / closed loop table : LOAD (or possibly a TPS-derived load input) vs N 'engine speed) with 0s and 1s in the table
- another LOAD vs N table with target lambdas in it. There will be a wide area at low/medium speeds and loads where lambda is 1.
- somewhere, there must be a fuction or table giving info to the system regarding the share of the scheduled fuelling between the 3 levels of injection.

Modifying fuelling for FI :
To calculate the engine air consumption, the engine essentually use MAFS data.
To estimate the fuel pulse width, the system uses a complex algorithm introducing all sorts of data, including injector related info.
The PCM is actually capable of adjusting by it self the fuelling based on the existing maps, but it will somewhere be limted by the system's diagnostic fucntions (whether they are a legal requirement - like OBD - or not). I can immediatelly identify 2 of them :
- a first one that compares at all times the measured mass air flow for a given TPS and engine speed to a inferred (= calculated + mapped) load value. If the difference is too high (due to FI for example) -> CEL & Limp Home...
- a second one has been extensively mentionned on this forum, it's the LTFuelTrim, or adaptive fuelling that is also limited (+/- 12.5 % if I remember correctly). Go above the limit and it's CEL and possibly Limp Home...

Fabrice

Last edited by Rasputin; Apr 5, 2006 at 04:10 AM.
Old Apr 5, 2006 | 05:25 AM
  #188  
tertou's Avatar
Registered User
 
Joined: Apr 2004
Posts: 55
Likes: 0
From: Belgium
Thanks for these enlightenments, Fabrice.
Old Apr 5, 2006 | 05:33 AM
  #189  
Rasputin's Avatar
Registered
 
Joined: Sep 2004
Posts: 581
Likes: 0
From: Europe
Originally Posted by tertou
Thanks for these enlightenments, Fabrice.
C'est toujours un plaisir, Thierry.
Old Apr 5, 2006 | 10:46 PM
  #190  
rxtreme's Avatar
Registered User
iTrader: (1)
 
Joined: Jul 2002
Posts: 347
Likes: 0
From: NY
- a first one that compares at all times the measured mass air flow for a given TPS and engine speed to a inferred (= calculated + mapped) load value. If the difference is too high (due to FI for example) -> CEL & Limp Home...
- a second one has been extensively mentionned on this forum, it's the LTFuelTrim, or adaptive fuelling that is also limited (+/- 12.5 % if I remember correctly). Go above the limit and it's CEL and possibly Limp Home...
So given this information, is it possible to determine how far FI (i.e. how much boost) can be applied with the stock ECU? Could RP use the stock ECU for his axialflow application?
Old Apr 5, 2006 | 11:39 PM
  #191  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
no RPs axial flow unit will run out of fuel with the stock maps.
Old Apr 6, 2006 | 10:43 AM
  #192  
rxtreme's Avatar
Registered User
iTrader: (1)
 
Joined: Jul 2002
Posts: 347
Likes: 0
From: NY
I am not talking about stock maps, I am trying to say can the stock ECU be modified enough (i.e. reflashed) to meet the needs of some FI requirements and what are those limits?
Old Apr 6, 2006 | 12:10 PM
  #193  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
it's a lot easier to hijack the system with either an internal or external piggyback controller

even if you get the maps figured out and how to alter them, figuring out the base code programming functions that determine the overall software control strategy is a much more difficult task.

Last edited by TeamRX8; Apr 6, 2006 at 12:13 PM.
Old Apr 6, 2006 | 01:17 PM
  #194  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
oh um yeah the limit is the stock fuel delivery . which i believe is enough for slightly over 300whp. more if you go with a complete set of the bigger "blue" injectors, maybe 350 whp(thats a guess i havent done the math.).
Old Apr 7, 2006 | 11:53 AM
  #195  
rxtreme's Avatar
Registered User
iTrader: (1)
 
Joined: Jul 2002
Posts: 347
Likes: 0
From: NY
300-350 WHP would not be bad with the stock ECU. Which, I believe, might be good enough for RP's application. All of you obviously know the advantages to using the stock ECU over anything available to date - even the Interceptor-X: no loss of auxillary functions (DSC, cruise, ABS, etc.), ability to keep a clean and stock appearance, and most likely cost. I really hope someone can crack the code. Can't anybody help us out as a dealership? Maybe get a loaner WDS? :P
Old Apr 7, 2006 | 12:42 PM
  #196  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
you get all that with the Astra Racing internal hijack mod plus it's fully compatible with WDS and can't be detected except by opening the box up, they have also cracked the immobilizer and can defeat it, meaning you can drop the computer into any RX-8, turn the key, and go ...
Old Apr 7, 2006 | 12:42 PM
  #197  
dannobre's Avatar
Modulated Moderator
iTrader: (3)
 
Joined: Feb 2004
Posts: 13,720
Likes: 344
From: Smallville
I'm afraid the WDS won't help you much. It doesn't allow the techs to do much more than read the available PID's. You can't effect permanent changes to the ECU with it.

Mazda factory engineers have laptops with interfaces to actually change or create new flashes....that's whaat we need to get our hands on
Old Apr 8, 2006 | 03:57 PM
  #198  
rxtreme's Avatar
Registered User
iTrader: (1)
 
Joined: Jul 2002
Posts: 347
Likes: 0
From: NY
Mazda factory engineers have laptops with interfaces to actually change or create new flashes....that's whaat we need to get our hands on
Well dammit, then, that is what we need. I know we have some Mazda mechanics or good friends of Mazda mechanics on this site that we can bribe. Come on, people: Unite! We need this like we need food and beer! I am willing to start an "ECU fund" and take donations for this major life turning event for all RX-8 owners. We could offer discounts for ECU flashes to all who make a minimum donation (say, 75 bucks) and be the first in line to get this incredible breakthru mod. I will, of course, need additional volunteers, mostly computer engineers and programmers to help out....Or maybe I am just suffering from delusions of grandeur?

Last edited by rxtreme; Apr 8, 2006 at 03:59 PM.
Old Apr 8, 2006 | 04:14 PM
  #199  
Nemesis8's Avatar
Bigus Rotus
iTrader: (3)
 
Joined: Jun 2004
Posts: 8,573
Likes: 1
From: Missouri
Dealership Mechanics don't have the laptops, the Factory engineers do...
Old Apr 8, 2006 | 04:22 PM
  #200  
dannobre's Avatar
Modulated Moderator
iTrader: (3)
 
Joined: Feb 2004
Posts: 13,720
Likes: 344
From: Smallville
Don't think we haven't tried


You have already rated this thread Rating: Thread Rating: 0 votes,  average.


All times are GMT -5. The time now is 09:37 AM.