Keywords: Fuel-Injection ECU EFI SUBARU WRX Impreza STI M37700 M37781 MELPS7700.

Analyze information of ECU for SUBARU EJ20

ec2-18-221-183-34.us-east-2.compute.amazonaws.com , 52984th

1999/10/18 UPDATED

NO WARRANTY
UNDER CONSTRUCTION

NOTICE

Analyze information of APEX PowerFC for GC8

MELPS7700 disassembler

SUBARU ECU monitor(U/C)

STi center diff controller photo

Analyzing diary

1996.4.1	got new car
1996.4.10	got underground ROM
1996.4.13	known waht is CPU
1996.4.18	got CPU users manual
1996.4.18	start making disassembler
1996.7.17	analyze communication interface circuit
1996.7.18	done disassembler, stating ROM analyze
1996.7.20	discoveried communication routines
1996.8.10	made RS232C adapter
1996.8.16	read ROM image from my car
1996.8.21	discoveried checksum routine
1996.8.23	discoveried address of the accell openity
1996.8.24	bought parts for make an external ROM board
1996.8.26	discoveried address of water temp
1996.9.5	discoveried address of air-flow
		speed limitter
		engine load
		R.P.M.
		start makeing external ROM board
1996.9.6	discoveried address of battery voltage
1996.9.11	done external ROM board, cut off speed limitter
1996.9.17	got information rev limitter, boost map
1996.9.23	starter SW, airconditioner SW, powersteering SW,
		D-test SW, ReadMemory SW, neutral SW,
		AccellPedal SW, Idleing SW
1996.9.25	ignition point, injector interval timer

about CPU

I seems that CPU is MITSUBISHI M377xx
disassembler for M377xx is available

How to use an external ROM

internal ROM goes disable at make high level at pin of "NUA". NUA is contacted to GND via jumper pin of J1. if you want to use an external ROM, cut a J1.

there is reserved socket for an external ROM, this socket is reserved for FUJITSU MBM27C1028. but, this ROM is already out of market. we can not get this ROM. so we must make an adapter of external ROM for 27C256.

prototype of external adapter

parts face

solder face

Reading internal ROM

there is the memory read connector at up allow of brake pedal. we can referencing internal memory by operation this terminal. SUBARU have the SELECT MONITER for diagnosis. they make a diagnosis contact this connector.

memory read connecter

interface voltage is TTL level(5V)

arround communication port in ECU

external view RS-232C level converter

schematic diagram RS-232C level converter

I analyzed program routine for communication, I found two commands read and write only. I seems SELECTMONITOR gets engine data is read from ECU work area direct.

communication format is, 1,953.6bps(CLK/2048) S8E1.

ECU detects end of command is counting received data length. ECU executes a command as soon as data received.

Command in binary mode(default)

command phase length +0 +1 +2 +3 description

memory read command 4 0x78 addr MSB addr LSB ' R ' read data from absolute memory. repeate until get another commands.

result 3X addr MSB addr LSB DATA -

memory write command 4 0xaa addr MSB addr LSB DATA write data to absolute memory

result 3 addr MSB addr LSB DATA - reread data from wrote address

clear command 1 0x12 - reset command phase

result 0 -

get ROM ID command 4 0x00 ' F ' ' H ' ' I ' get ROM ID

result 3 ID #0 ID #1 ID #2 -

Command in binary mode(default)
command	phase	length	+0	+1	+2	+3	description
memory read	command	4	0x78	addr MSB	addr LSB	' R '	read data from absolute memory. repeate until get another commands.
result	3X	addr MSB	addr LSB	DATA	-
memory write	command	4	0xaa	addr MSB	addr LSB	DATA	write data to absolute memory
result	3	addr MSB	addr LSB	DATA	-	reread data from wrote address
clear	command	1	0x12	-	reset command phase
result	0	-
get ROM ID	command	4	0x00	' F '	' H '	' I '	get ROM ID
result	3	ID #0	ID #1	ID #2	-

Do not wait between command sending grater than 12 communication cycle. if time out, command will revoke.

ECU executes read command, clear command only at first condition.

ECU accepts the get ID command and wirte command at executing read command.

Command in ASCII mode(optional)
command	phase	length	+0	+1	+2	+3	+4	+5	+6	+7	description
memory read	command	6	0x7f	MSB		LSB		' R '		-	read data from absolute memory
memory read	result	8	addr MSB		addr LSB		DATA		CR	LF	read data from absolute memory
memory write	command	6	0x20	MSB		LSB		DATA		-	write data to absolute memory
memory write	result	8	addr MSB		addr LSB		DATA		CR	LF	reread data from wrote address
clear	command	1	0x12	-							reset command phase
clear	result	0	-								reset command phase

parameter address(no warranty)
ID	name	desc	A/D#	monitor addr	int addr	unit
F01	VB	battery	2	0x1335	0x1046.w	Mon:E[V] = N * 0.08
F02
F03	VSP	speed VSP		0x1336	0x1075	V[Km/h] = N * 2
F04	EREV	engine RPM		0x1338	0x121c.w	Mon:R[RPM] = N * 25, internal:R[RPM] = 120000000 / N
F05
F06	TW	water temp	1	0x1337	0x1268.w
F07	ADVS	ignition point		0x1053		BTDC[deg]
F08	QA	air flow signal	0	0x1308	0x1042.w	( Vadc = N / 200 )
F09	LDATA	engine load		0x1305
F10	THV	throttle signal	4	0x1329	0x1262.w	Mon:THV[%] = N / 2.56
F11	TIM	injector time width		0x1306	0x10c0.w	$1306 = $10c0.w / 64, $10c0.w * 4usec = real INJ time?, $1306 * 64 * 4 * 1000 = real INJ time[msec]
F12	ISC	ISC valve duty
F13	O2	O2 sensor signal
F14	O2Max	O2 sensor signal Max
F15	O2Min	O2 sensor signal Min
F16	ALPHA	A/F correction coefficient
F17	RTRD	ignition point correction
F18	WGC	boost control duty
F19	BARO.P	open air pressure	5	0x1340		P[mmHg] = N / 2 - 260?
F20	MANI.P	current boost	5	0x1341	0x12c4.w	P[mmHg] = N / 2 - 260?
F21
F22
F23	EXTEMP	exsaust temp
FA0.1	IG	IGN SW
FA0.3	UD	TEST SW		0x1343:5	0x2200:1
FA0.4	RM	READ MEMORY SW		0x1343:4	0x2200:2
FA0.6	AS	ACCELL SW		0x1343:3	0x2200:6
FA0.7	NT	NEUTRAL SW		0x1343:2	0x2000:0
FA0.9	SS	STEERING SW		0x1343:0	0x2200:7
FA1.1	ID	IDLE SW		0x1344:7	0x2000:4
FA1.2	AC	AIR CONDITIONER SW		0x1344:6	0x2000:1
FA1.3	AR	AIR CONDITIONER RELAY SW
FA1.4	R1	RADIATOR FAN1 SW
FA1.5	R2	RADIATOR FAN2 SW
FA1.6	FP	FUEL PUMP SW
FA1.8	KS	KNOCK SIGNAL
FA2.1	MC	N/A
FA2.2	IC	N/A
FA2.3	BR	OPEN AIR SWITCH SOLENOID
FA3.10	O2	O2 MONITOR
[OTHER]
		STARTER SW			0x2000:2

E-mail	-- LINK FREE --
HOME		LAST

Analyze information of ECU for SUBARU EJ20

NO WARRANTYUNDER CONSTRUCTION