Any New Break-throughs With Ecu Hacking?

[drlava]

sure, pull it off and send it if you can.

Here are the turbo EFI ECU pinouts for all of the peripherals that it monitors (oxygen sensors, throttle position, engine coolant temp, turbo press, etc.) and drives such as the injectors

PIC1 (main ECU pinout)

PIC2 (Component diagrams)

Getting the circuit path internally from these pins to the ECU would be helpful. For example, how does it sample current from the front O2 sensor heater circuit going in to pin 14? an aspiring EE could track that down. I would if I had a spare ECU.

[n8-50]

sure, pull it off and send it if you can.

Here are the turbo EFI ECU pinouts for all of the peripherals that it monitors (oxygen sensors, throttle position, engine coolant temp, turbo press, etc.) and drives such as the injectors

PIC1 (main ECU pinout)

PIC2 (Component diagrams)

Getting the circuit path internally from these pins to the ECU would be helpful. For example, how does it sample current from the front O2 sensor heater circuit going in to pin 14? an aspiring EE could track that down. I would if I had a spare ECU.

I working on getting a setup to monitor the signals at the components in the rest of the car. I've already got some limited results, but I need to figure out my hardware a little better to take high sample rates. Right now I have some 100 sample/ sec results from the CPS and coil. My logger is capable of logging 16 channels, with up to 4 of those at 1000 samples per second. I still have to figure out how to set up the higher sampling rate though. If there's anything in particular I should be looking at, let me know.

n8

[Chris Taylor]

N8, what are you using to log all this information? Sounds interesting.

[n8-50]

N8, what are you using to log all this information? Sounds interesting.

It's called a Labjack. I've got the U3. It's a pretty cool thing for only $100. I've been having very intermitant starting problems, so I got one about 2 weeks ago to poke around my car with. I'm working on building some Op Amp buffers (I'm waiting on the boards). I also picked up a bunch of thermistors to build temperature probes and a pressure gauge from mouser to build a boost gauge. Here's the reading I got off the wires going to the coil and amplifier with it. I got some off the CPS too, but I had trouble getting connections to the wires, and the connections only worked for a little bit (and then the CPS stopped working and I had to pull my wires out). I think some thin magnet wire may fix those problems though.

[paulr]

Why not pick up a MAP sensor off ebay? homegrown modder spirit, or is there some practical benefit? a 3-bar sensor can be had for well under $50, probably around $20 if you look hard. I'd be interested to see what progress you make with the thermistors, I had thought about doing something similar for oil / coolant / air, but saw too many potential problems (especially with oil) and gave up. Also, is 1khz resolution necessary? or is there no in-between? 100Hz should be good through 6000RPM. Anyway that labjack looks very cool for $100... and one could probably figure out a way to convert the logs to automotive log analysis software with minimal effort, just write a simple convert program to create the right format.

[Chris Taylor]

Seems like a useful tool for more than just cars. Nice find. Is there any way of changing the resolution of the voltage on those graphs?

[n8-50]

Seems like a useful tool for more than just cars. Nice find. Is there any way of changing the resolution of the voltage on those graphs?

Yeah. My car is really the only machine I really need 16 channels at once for though. The voltage resolution is 12 bits (2^12 possible measurements) which is pretty good. The device reads 0-2.6 volts, but you can set up 2 resistors in series, read the voltage drop off just one, and calculate the total drop across the 2 resistors. This lets you measure any reasonable voltage, as long as you have an idea of what range it is and the appropriate resistors. That's how I got these readings. The sampling interval is adjustable down to 0.01 seconds, and there's a streaming mode down to 4000 total samples / second (or 1000 samples/ second on a max of 4 channels) that I haven't figured out yet. I think you can also choose to take max, min or avg, or instantaneous voltages.

I didn't realize it at the time, but the pressure sensor I got is essentially the sensor chip from a MAP sensor. The one I got is made by a company called Freescale and was $15.10. The ones on ebay would work too and are probably packaged a little better for the under the hood environment. They had different ranges, but mine is good to 36 psi (2 bar gauge, 3 bar absolute at sea level). That will be more boost than I ever put in this car . To sample ignition stuff you're best off with as much sampling resolution as you can get. 6000 rpm is 100 rps, but you have 5 firing events in a 5 cylinder engine so that brings it up to 500 events per second. Theoretically you can get away with sampling a wave twice per cycle (the peak and the trough), but you need to do postprocessing to get a true representation at that resolution. Look up the Nyquist frequency/Nyquist Rate on wikipedia to see how that works. I guess though that since each thing only fires once every 0.01 seconds, 1000hz sampling would be pretty usefull. The logging software that came with the thing spits out csv text files, which is just about the most universal format around, so it would mainly be an issue of figuring out what format the automotive log analysis s/w wanted to see. I did my stuff in excel.

So drlava, these maps are essentially just linked lists? I think it would be helpful to parse the numbers of the values for the maps into something universal like csv's and then spreadsheets. I could log some stuff with the tps and rpms, but I guess it would require multivariate analysis to get any results back for individual parameters.

n8

[drlava]

The maps are represented in the ROM as hex numbers. It's unclear what each map does exactly, or even what the units are without a DAMOS or ASAP2 file, or some major reverse engineering of the code. Multivariate analysis seems like an even longer shot, but getting more data is always good !

I found the trouble code (Diagnostic port A2 blink) map is at 0xE710 in the hex file. It begins with the 'no trouble' code 1-1-1. However finding how these are specifically thrown is still difficult.

[Chris Taylor]

This might help some people move this along a bit further.

Originally PM'd by EOBD

There are tow tables that need to be modded, that's what we did when doing the upsolute custom job. I will see if I hae notes or backup somewhere, but can not promise as been a long time.

Would be good to see if this went further than it did before when it went around the .....nth...... time.

Will get back to you in a few days or so.

Rick

No response back yet but I'll keep everyone posted with his response. Or Rick you could add it here if you'd like... They don't bite anymore it seems. . . heh

[BillKlineVT]

First post here... I recently picked up a 94 850 Turbo...

Based on my experience with tuning Nissan ECU's, the first map pictured above appears to be something like a "target a/f" table, and the second appears to be a "fuel trim" map.

Not sure what the 3rd map could be...

The 4th map appears to be the Primary Ignition Timing map, due to the slope of the curve (Timing starts high and gradually slopes (decreases) as throttle % (and thus, boost) increases).

The 5th appears to be the Secondary Timing map(say if knock is detected), based on the major drop in timing about halfway through the "slope"... that chunk taken out is most likely the area where the car is in boost, since they harshly cut the timing to save the engine when knock is detected.

The other maps with lower resolution (larger squares) are probably sensor calibrations, and most likely one or more has to do with boost control (actuator duty cycle, boost level, etc.)

Hope that helps... I'm willing to dive into this as well - I'm a Computer Engineer so I'm here to help :)

[drlava]

BillKlineVT, that's a good start, send me a PM with your email..

[n8-50]

Has anyone used an xray scanning service here? Would it be reasonable to send an ECU board off to a service to be scanned? I'd be willing to pitch in some bucks and organize it if so. I don't have a spare ECU though. Just a thought.

n8

So it looks like most xray scanning services are small area scans (like 1cm x cm?). A film scanner might be useful, but I have no idea where I'd get that done. Anyone work in a doctor's office? :)

[Chris Taylor]

Has anyone used an xray scanning service here? Would it be reasonable to send an ECU board off to a service to be scanned? I'd be willing to pitch in some bucks and organize it if so. I don't have a spare ECU though. Just a thought.

n8

So it looks like most xray scanning services are small area scans (like 1cm x cm?). A film scanner might be useful, but I have no idea where I'd get that done. Anyone work in a doctor's office?

My stepmom is a Radiologist. I'd have to ask if she could do such a thing then ship an ECU board out to her in AZ.

[matt1122]

Oh god, here you all go trying to blow up your cars.

[Chris Taylor]

I'm not exactly trying to blow my engine. I'd just prefer to not use a stand alone system or have to send out my ECU 4+ times to get the car tuned properly after quite a few modifications.