seikx8

Instead of revise the "cracking the ecu" thread, I want to start a new one with all information update and put in one thread so that we may share what we have and keep this thread more clean.

Currently there are a few solutions for reflashing the ECU. However from reading the forum and research, the following are the break down:

One is the AccessPORT, if you go with this route, buy from MazdaManiac with tuning support. This one is good for professional tuning as it protect the tuners' properties/maps.

The second one is Hyme's sCANalyser Pro Tuner. This is the best solution for those that want to tune it yourself or get a group of people to chip in to buy the hardware and shared to cost and would allow you to tuned multiple cars; best cheapest solution you can buy.

Third, well go with my solution loL! DIY using mazda flashing software and the J2534 device. This will allow you to invest more with other cars model as well keep update to the most recent flash put out by mazda. This is also why I would recommend Hyme's solution as I'm sure one day who know, J2534 API may offer for the sCANalyser unit.

The other I think it's EFIDude? Since I have no info, I will not discuss this. From the open ecu end, they are working on the J2534 as well, but I don't know if it will be another option for us RX8; I'll leave it to you to find out and decide the rest and will not debate on who is better than who :p

Now come the fun part. Lucky for those users at open ecu they have a handful of supports and map created by users and all the good stuffs, etc. and that makes me jealous in many ways. So what I am proposing is since we have the solution for us to flash the PCM, we should create some user knowledge sharing to shared our finding and creation openly; and of course leave the copyright materials to those who owned as secret, such as professional map created and tune by vendors, etc.

I will use this thread to keep everyone up date and share more information as I found suitable and I would like to thanks a few other in this forum as they have help me sourcing the material I need to place my PCM on bench and you know who you are.

I would like to start out with the most basic information as these are the information would be most useful for everyone and working from there. Currently this is the tentative list of information that I would like to discuss and shared:

1. How to change the FAN control coolant temperature
2. How to disable CEL DTC codes
3. Identifying different map: Meter Oil Pump, Ignition, Fuel, etc.
4. How to search and verify for map from scratch with the help an disassembler.
5. How to scale each map to support FI
And the more advance for the code at heart:
6. How to create multiple maps and switching between them
7. How to create other features not available, like turning the dummy oil gauge to something useful, launch control, etc

For me, I don't think 6-7 will be achievable by myself but just want to throw some idea around and hope one day we might have enough info to piece them together.

For today, I would like to share the following:

Since I'm working on my car with flashID n3z2et (2003-2004 Cal MT), all reference location and values are coming from this flash version. I have completed disassemble the flash as I was working on and off in the past 6 months and will be using my spared PCM as a guinea pig. If you want to contribute with other flash version, please add to the thread and If I have time, I might be able to pull the same info from different version as once the code is located from one version, searching for the same information should be quite easy from the next version as our PCM speak bigendian language once you understand them

I have a few forum member that offer me accessing to new flash file, I will pm you in due time when I'm ready to work on those new files


How to turn on fan at lower coolant temperature?
There are three fan control modes:

1. Low speed two fans
2. Hi speed single fan
3. Hi Speed two fans

In the flash, there are three location for ECT value and only two modes are use.
Low speed two fan turn on at 97°C, turn off at 94°C
Hi speed two fans turn on 101°C, turn off at 98°C.

ECT value in 32bit float data type for fan control:

Fan Control #1Fan Control #2Fan Control #3How do I disable the Check Engine Light for each DTC Codes?
There are 4 tables, 1 DTC code lookup table, 3 monitoring sub-routines monitoring status table, some are checked and stored if errors and some just check and warning.So let say if you want to disable P0420 code, you would set all value to zero in the three monitor table at position 43rd: 0x7C9FC+42, 0x7CA88+42, 0x7CB14+42, in an array, the table index start at 0, so the 43rd position has index of 42.

For anti-thelf disabling, I think placing all zero on 74th position for P1260 should do something, but I doubt it's that simple; I need yet to verify.

Next order of business are rom check sum: 0x7fb80, 3 x 32bits int


For more advance stuffs:

Scaling tables:
ECT Sensor scaling: 0x6F430, 32 x 32bits float
MAF Sensor scaling: 0x6F65C, 48 x 32bits float
IAT Sensor scaling: 0x6FAB0, 16 x 32bits float

I also have some information about Metter Oil pump and the fuel/ignition map. Still need to working on the injectors pulse and will share that next time after I complete piecing together my Turbo project.

And the following attached screenshot are for a sneak peak at what I'm working on. In due time, you all will have access to these information, so keep this thread clean and well behave. If you scratch my back, I'll scratch your?

FlashEdit.zip contains application FlashEdit.exe (required .net 2.0 Framework to run) and definition file SW-N3Z2ET000.xml

The binary romz file is too big to upload, pm me if you need one.

seikx8

Reserved for future use
So I need to wait 30s for each post?

seikx8

Reserved for future use #2

seikx8

Reserved for future use #3
You may post your reply below

Brettus

iTrader: (2)

I'm not sure you have the fan functions correct .
My understanding was
1 2 fans low speed 97C
2 max temp allowable with motor off . 97C IE turns fans on if temp goes over this with engine off . Not sure on this though .....
3 2 fans high speed 101C

seikx8

if that is correct, then I need to re check the assembly codes for the 3 values location. Reason I believed there is a 3 modes fan setup is because of the two temp are same, one of the branch statement in the assembly code checking the two location would of trigger a different flag if the temp are different but with current same temp #, it never have a chance to execute. Also if you check the wiring diagram on how the fans are hooked up, you will see what I mean. Btw, don't confuse the control # with mode #, they are independent description and notice I choose the word carefully not to use FAN1 or FAN2, etc. You need the combination of the 3 controls/flags to create 3 different modes. Now if you enter all location with same number, you would create a single mode on/off hi speed fan.

Low speed = two fans running hooked up in series (high resistant? whatever the electrical term is).
Hi speed = two fan running hooked up in parallel (low resistant?).
If you trigger the switches correctly, you can have one of the fan run by itself at high speed (passenger side I believe).

So total 3 combined modes. If you happened to edit the two entries for 97, you want to edit at both location to preserve the factory two setting modes, otherwise, you will create the third mode which is a one fan hi-speed mode. Question is why Mazda chose to use 2 modes instead of 3? And why they use low/hi speed two fans instead of single speed 1 or 2 fan?

When the motor is off the coolant and other temp (IAT & ambient temp) will play the role of triggering the fan on/off (I still need to verify what is the threshold value are); if the engine happen to be on HI speed 2 fan, it will stay on until other event trigger (key off will not trigger the fan off if the temp is above certain number that is not define in that table mentioned and it is a constant set in the rom at other places and there are other trigger that cause the fan to swith on/off after key off); because the coolant is not circulating when engine is off, cooling the radiator will not cool down the water in the engine that much. This is also why sometime when the fan is on after you turn off the key, and you turn back on/off again, the fan would stop if the engine bay wasn't that hot.

in due time I will prove or disprove this claim with my PCM on bench, unless someone already done this can confirm.

Brettus

iTrader: (2)

would be good to know for sure . The way i read the wireing diagram the 3 possible modes are :

2 fans on slow
1 fan on slow 1 on fast
2 fans on fast

anyway , good work i will follow your thread with interest ....

swoope

iTrader: (5)

seikx8

connectors are good?

good job.

beers

arghx7

If anyone wants to see the AccessTuner instructions, which defines a bunch of maps in the PCM and what they do, I'll put them here: http://www.geocities.com/arghx/Rx-8_AccessTuner.pdf

There is an explanation of cooling fan function and its associated tables on pages 24-25.

Also, I have the SAE J2534 standards "Recommended Practice for Pass-Thru Vehicle Programming" (2002) and the 2006 update, "Optional Pass-Thru Features" in PDF form. PM me about it.

seikx8

Thank to you and other, I got all the connectors and some extra plugs with no pins, after talking to one of my college friend recently, which I forgot he is working as an engineer told me I should of call him and could source those connectors and pins easily So lesson learned is to keep in touch with your buddy, however that cannot compared to the kindness from most of these forum members

I'm still working on the wiring to simulate the ignition key acc/on/off, etc.. otherwise everything look good.

seikx8

That document does give a lot of info. Look like I don't need to do much of the homework and can just piece the info from the ROM location to the description. Thanks for the cheat sheet and that's a lot of knowledge to digest

For the fan control, it still doesn't explain what fan1 a & fan1 b does to the actual fan switches, pretty vague description. About the fan2 vss, I missed the vehicle speed part.

swoope

iTrader: (5)

uh, no.

thanks for keeping of with the project. i just gave you stuff that was going to rot in my garage!

beers

seikx8

You got the "1 fan on slow 1 on fast" wrong you can't have a low speed fan without changing its resistant (connecting it to a resistor)
I was bored, so I created this diagram showing 3 different circuits by grounding the 2 pcm pins in 3 different combination to drive the 3 relays.

seikx8

It's like a hobby that have no end
I don't think they'll rot, more of paper weight?

vansickey

Our map locations will vary depending on flashes, like my MAF is 0x6e694, and IAT is 0x6e4a0. I have a few other ones verified. Something that is puzzing my right now is, whether or not there are 1-2, 3-4, & 5-6, or 1-4, 5-6 & Hysteresis. Originally I worked on this and conclude the latter of those, but have read about others claiming the former. The dtc thing is great info, I hope I can find that in my rom, and work with it, that has been something I have been interested in, but havent looked into yet, thanks for the direction. The oil metering table I originally confused it with a fueling limp mode and didn't touch it but I am pretty sure I have it identified properly at 0x77c78 20X20. I have some other tables like the baro comps, injector size, o2 sensor, primary idle speed, rev limiter and others. I have been working with both CA model and non Cali flashes. Let's figure this thing out.

shaunv74

It's different from year to year.

04 has 1-2 3-4 5-6 and Hysteresis
05 has 2 maps plus Hysteresis
06-08and up has 2 maps and Hysteresis but is different from 05 in other respects.
09 is different but I don't know how.

I'm not sure of the differences this is information Jeff (MM) passed on to me in our talks.

So there are 4 different software versions of the PCM for the RX8.

PhillipM

Slight hijack, but can you pull the stock ignition map out of there for comparision with my own?

Brettus

iTrader: (2)

Good work .

r0tor

iTrader: (1)

Here you go... https://www.rx8club.com/showpost.php...1&postcount=31


Hows that 3 rotor renesis coming along?

PhillipM

Well, the good news is I have bought two spare donor engines for the grand total of £2 (~$3), bad new is they're both pretty knackered, but hey, gettting stripped down anyway...

vansickey

I've been looking into the S-DAIS, and it looks like the SSV valve actually opens at 3000 RPM, not the original 3750 as advertised, can anyone confirm this or dispute?

vansickey

I was looking at your map at 6DB14, and I have a similar map at 6bc3C. Awhile ago when I started tuning on this thing,I unplugged my o2 to get out of closed loop which made me a bit lean at idle, and I increased the table values and it brought my idle afr's back down... Strange, right? Unfortunately, at that moment, I wasn't monitoring the timing. Looking at it again, with the two matching tables, it would make sense to be a leading and trailing timing table, but it doesn't match my actual advance at idle either.

vansickey

Okay, so if I get this right the DTC bits are
00 No check
01 Check
03 Check Shutdown
05 Check Limp

vansickey

My 04 doesn't have 4 tables, just 3. 1-4 5+6 + Hyst. Plus how about some talk on the strategies Mazda uses for map switching, like TP fueling compared to Load. Or the Oil metering... Is it strictly by RPM that makes the transition? Something else I was looking for, was the VSS fan operation... Is it 40 & 32? During an autox event I was be leaving the course around 205-210 F. I'd like to keep the fan on longer so High rpm heat, with lower vehicle speeds, it can still cool more. Any thoughts?

vansickey

More fan stuff from Mazda